Clarifications/feedback on build system

[nlgranger]

I tried to understand why the Archlinux package for edk2-ovmf hasn't been updated for a while and listing the dependency tree with versions and checksums proved a bit hard.

Besides the packaging struggle, it also increases the risk of supply chain attack on this project which, I assume, is being used in production. Also just for clarification, I understand edk2 is not your usual c++ project with a CMakeLists.txt, I'm trying to provide some feedback and suggestions, not to rant.

1. Is the "build" method still supported?

This

Note: New build instructions are available. It is recommended to start with the new instructions if learning how to build edk2 for the first time. This page is retained for reference.

Contradicts this:

So, you can still call build directly.

2. Some dependencies seem they could be optional

• lcov-cobertura
• pygount
• openpyxl and XlsxWriter

3. Some dependencies are very small, maybe copy paste the necessary lines of code

• semantic_version

4. Using git submodule update --init instead of --recurse is a bit odd. It's also not supported by archlinux build system.