How do you store third party libraries that you use in your project in your source control?
When would you store binaries in your source control?
When would you store the code in your source control?
Would you ever store both? In what situations would you do this?
(Btw, I'm using .NET but it doesn't really matter for this question)
Assuming you are using .Net:
I create a "Libraries" folder in my project and source control that contains any third party assemblies.
My solution then references those assemblies and my build process pulls that folder down to our build server.
Any one pulling your code from source control should be able to compile it without having to hunt down references and assemblies.
Conceptually you need to store at least the binaries (and the headers if you do C/C++) That's usually the only way with third party libraries where you don't have the source.
If you have the source you can opt to store the source and build the third party libraries in your build process.
My experience has been to create a "lib" folder and keep all 3rd party binaries in there. I will create a totally separate tree for the Source Code to these third parties if it is available.
Some places where this might be different is if you are using an open source vs. a retail 3rd party, with open source solutions I tend to just include the code in my projects and not check-in the binaries.
You should be able to install a fresh OS, get your sources from source control, built and run. So yes, you should put them in source control.
It depends on how big they are. When binaries or installers are too big, it can cause havoc for remote users. The upside of storing binaries and installers is that everything a developer needs to get up and running is in source control and the versions are correct. If you have a separate installation location, versions can get messed up. So, in general I like to store small or moderate binaries in source control, but larger ones I leave out.
Edit: Oh, and I call mine "BinRef" :)
How: a vendor branch is generally a good approach
When (thirdparties): for minimizing the number of referential involved: you could add those libraries into a separate external referential (like Maven), but that mean you need to access that extra referential for each of your environment (development - integration - homologation - preproduction - production)
When (code): for managing the complexity of the changes, when you know updates and fixes for current versions running into production will be needed while new development are in progress.
Why (store both): for deployment reason: you can manage a complete configuration (list of elements you need) in one referential and query it wherever and whenever you need for:
For test and production environments, that also mean your own product (the packaged result of what you are building) should also go into your SCM (only the official releases, not the intermediate ones used internally).
If other projects depend on your product, they will build their own project against your packaged version stored in the SCM, not against your source code they somehow recompiled.
Why this is important ?
Because in the end, what will run in production is that packaged version of your product, not your "source code re-compiled". Hence the importance to make all your test with the target final form of your product, clearly stored and tagged in your SCM.
Martin Lazar raises a legitimate point in his answer
Source control is called "source" control, because it is supposed to control sources.
While that may have been historically true, every current RCS have evolved toward SCM (Source Code Management), which does not just control sources, but also manages changes to documents, programs, and other information stored as computer files.
Binaries can then been stored (even stored with binary-delta)
Plus that allows some of those SCM to propose S"C"M feature (as in Source Configuration Management).
That SCM (Configuration) not only stores any kind of "set of files", but also their relationships (aka dependencies) between those sets, in order for you to query one set of file, and to "pull" every other deliveries on which that set depends on (to build or to deploy or to run)
You don't need to store third party libraries in your source control repository. Those libraries (think of SDL, libcurl, etc.) should always be available on the web.
Just two raccomandations:
How do you store third party libraries that you use in your project in your source control?
As binary or source or both. Depends on the library.
When would you store binaries in your source control?
A third party library for which we don't have the source or an internal library which we haven't made any changes to or the library is too huge to be built around.
When would you store the code in your source control?
Say, we use an internal library A but have made some bug fixed specific to product X. Then product X's depot will keep the source and build it.
Would you ever store both? In what situations would you do this?
Yes, all the latest binaries are stored in source control.
So the tree looks like this:
product
|-- src
|-- build
|-- lib
|- 3rdparty
|- internal
...
I don't put 3rd party source or binaries in SC. My rationale was that I would not have to update SC just to update the libraries. I am starting to regret this though. When I have had to recreate the project I find myself running around looking for the lib sources instead of just syncing to SC.
On a recent Java project I switched to using Maven - this was quite nice since it meant I didn't need to store any third party jars in a lib/ directory. At compile time maven would pull in the dependencies. One nice side affect is the jars have the version number in their filename.
Source control is called "source" control, because it is supposed to control sources..
In Java it's common pattern to use some version control system to store sources and other resources like configuration XML files or pictures, and than to use some dependency management tool like Apache Maven, which will store, download and manage your project's dependencies on 3rd party libraries. Then when you reinstall your OS, Maven can automatically download your dependecies from central repository (or your own private repositories as well) and store them in a local cache on your disk. You don't even have to know where the cache is :)
Maven can be also used with other languages and as far as I know plugins for .net and C/C++ are available, but I haven't used it with anything else than Java.
Generally speaking, I would do roughly what has been prescribed by other users.
In the case of Subversion, and I admit I can't speak to the inclusion of the feature in the case of other systems, one can use an External to link in a repository maintained elsewhere. In a checkout/export, you'll get a full copy of the source including the updated code from that external repository all in one go.
This was particularly nice for me with PHP/JS development as there is no issue regarding storing binaries. I'd keep an external of the Zend Framework, Doctrine ORM, and jQuery all in a /lib/ folder of the project. Every update would give me a complete, updated copy of -all- the necessary files without any more work than adding that repository URL to an svn property.
When would you store binaries in your source control?
I store binaries in source control when I want they ability to quickly revert back to the old version of an application. There are number of reason I would do this, those include the following:
If you are using git (which I recommend), and you have the source of the third party library, then storing the library in its own git repository and including it as a submodule is an excellent setup.
If the source library is also using git then you can clone their library and push it to your own server so you'll never lose it.
Git submodules allow you to specify which revision of a library is required for a project, which is great for maintaining compatibility.