Currently I see the developers of charm fetch the required libraries from charmhub and make the source code of libraries as part of charm repo.
Is it possible to specify the libraries as part of charmcraft yaml so that charmcraft pack command can fetch the libraries as part of build/pack process?
The reasons for asking this question:
a change in library requires to submit patches for all the charms that use the library.
Looking at source code, there is no way to distinguish the libraries that are fetched and that are published by charm (need to check via charmhub).
tox in charm should instruct pep8/flake to discard fetched libs since the original libraries might have verified with different pep8/flake rules. (this is not a big deal though, just mentioning)
The problem with updating all libraries as part of the pack process is that the developer may not want to always have all libraries updated (for sure not changing the major API number, but maybe not even the minor one).
Note that if you update a library, you should not patch all the charms that use that library automatically, as you may be breaking the usage of that library from the charm. The charm developer, if they want, can update the libraries they use at the moment of fixing/improving the charm code, running all the appropriate tests, etc.
Something we DO want to improve is the alert to the developer that a more updated library version is available (but never update it automatically). We’re tracking that behaviour in this Github issue: charmcraft analyze - check for library modifications.
