Re: [boost] [VS2017][release] vswhere.exe

Subject: Re: [boost] [VS2017][release] vswhere.exe
From: Andrey Semashev (andrey.semashev_at_[hidden])
Date: 2017-03-30 16:44:30

On 03/30/17 18:46, Rene Rivera via Boost wrote:
> On Thu, Mar 30, 2017 at 10:20 AM, Glen Fernandes via Boost <
> boost_at_[hidden]> wrote:
>
>> Mateusz wrote:
>>> The utility is not deployed by any VS installer.
>>> You need to download it separately, from GitHub.
>>
>> I hope that does not mean the Boost release itself would have to contain a
>> Windows executable for the purpose of finding VS.
>
> That is the general recommendation from Microsoft.

IMO, requiring a BLOB executable in a source distribution is 
unacceptable (regardless of the license of the BLOB). This compromises 
distribution transparency and may affect its review and certification, 
if one is performed by Boost users. This also raises a security issue 
since the executable may be compromised and contain malware.

I consider vswhere a part of the toolchain. We do not distribute 
toolchains in our releases, and we should not make an exception for 
MSVC. If MS cannot supply this tool in VS installers or as an OS update, 
and we still want to use it, make it a precondition for the users to 
install first and add a link to the Getting Started page. But please, 
don't put BLOBs into the source distributions.