use the find package in cmake optionally, now only vendored using submodules

[gocarlos]

By doing this we can use e.g. debian packages and do find_package or conan

debian

Todo

conan

most of the dependencies are already available in the conan center...

currently the submodules are forks of (patched) dependencies, probably this not the future we want to have

• [x] catch
• [x] fmtlib
• [x] json
• [x] mbedtls
• [x] cn-cbor
• [x] COSE-C
• [x] libevent
• [x] mdns -> https://github.com/conan-io/conan-center-index/pull/974

eventually

• [x] replxx -> https://github.com/conan-io/conan-center-index/pull/968

https://github.com/openthread/ot-commissioner/issues/4

[gocarlos]

related: https://github.com/cose-wg/COSE-C/pull/71

[wgtdkp]

I am not sure if conan is the official way to go. Does conan support compiling binaries with specific configuration option? Take COSE-C for example, I'd like it be built with mbedtls rather than openSSL.

[gocarlos]

I am not sure if conan is the official way to go. Does conan support compiling binaries with specific configuration option? Take COSE-C for example, I'd like it be built with mbedtls rather than openSSL.

sure, I'm doing exactly this with libcoap: https://github.com/conan-io/conan-center-index/pull/929

[gocarlos]

the C and CXX are passed to the build scripts to make sure all libraries are done with the same flags. libcxx and architecture

[wgtdkp]

@gocarlos There are other users from the community that thinking conan will be problematic for their usage. I think git submodule currently works well for OT Commissioner (as many other opensource projects do). I am going to keep it as it is but you can still use conan on your own fork. Thanks for your efforts on this issue!

[gocarlos]

Actually the issue is not only for conan but in general: the cmake script should have an option to use the vendored dependencies or try to find the dependencies in the cmake_root...

This is important as when linking this library to other libs that e.g. also use MBEDTLS and so this in the standart way (find_package) then we get evtl. two versions of the same lib in the binary -> UB

This is important for debian packagers, conan psckagers, yocto packagers etc.

[wgtdkp]

@gocarlos include dependencies with cmake find_package makes sense to me. Would you like to make a PR?