For distro packagers, is the idea that this should have SONAME libabseil.so.0 and remain at libabseil.so.0 forever?
(I know Google's preferred option is that we all realize that concepts like "distros" and "shared libraries" and "SONAMEs" are so last century, and tbh they are, but we'll have them for a long time yet, and it's helpful for upstream libraries to declare what their preferred SONAME is so that you can use the same dynamically-linked compiled binary on multiple distros.)
Ugh, I missed that they promise indefinite API compatibility but not ABI compatibility.
Distros aren't going to like "statically link it, and recompile all the reverse-dependencies when there's a CVE" at all, but I totally understand why that's a sensible approach for something that Google releases.
It’s hard to see the value here of dynamic linking vs static linking, especially when it seems like a lot of the value is compile-time selection of implementations and lightweight utility code—not exactly a huge attack vector you’d want to be able to upgrade independently.
And of course it introduces dependency hell, which seems like a poor fit for a library without a consistent ABI.
(I know Google's preferred option is that we all realize that concepts like "distros" and "shared libraries" and "SONAMEs" are so last century, and tbh they are, but we'll have them for a long time yet, and it's helpful for upstream libraries to declare what their preferred SONAME is so that you can use the same dynamically-linked compiled binary on multiple distros.)