dependency on third-party distributions

[cc32d9]

The EOSIO repository depends on submodules from third-party authors on Github. Those libraries may eventually disappear or break. Some of these libraries, like https://github.com/cryptonomex/secp256k1-zkp.git haven't been updated since long time (2015). secp256k1-zkp has also no master branch which causes errors in recursive submodules upgrades.

I believe B1 needs to maintain clones of those repositories that the software depends upon.

[spoonincode]

@cc32d9 you called out the secp256k1 fork explicitly, and I think that concern was reasonable. Now that it's resolved are there others you'd like to see handled differently?

[cc32d9]

I don't know, but basically any removal of a dependency repository will disrupt the process, so it makes sense to clone all third-party repos

[spoonincode]

Unless there is a specific concern I would vote to close this. We have to draw the line somewhere -- we can't mirror the entire Ubuntu source code or something. Most of the current deps are quite high profile and unlikely to disappear IMO. Since this is tracked in Jira, calling @aclark-b1 for input