VC runtime dependency

[ThomasFOG]

Hello there!

The build of cimgui for win-x64 and win-arm64 has a dependency toward the 140 VC Runtime.

It would be nicer and safer for users that the C runtime is statically built into cimgui so that the dll is monolithic.

The native build script can be adapted by adding -D CMAKE_MSVC_RUNTIME_LIBRARY=MultiThreaded to the CMake arguments.

I can submit a PR for that if need be.

Cheers!

[tuket]

Hi, thanks for the report!
Excuse my ignorance: what would be the benefit of this?
Wouldn't the .dll be bigger if the C runtime is linked statically?

[ThomasFOG]

It would be very slightly bigger, but it comes with benefits that largely outweigh a few KB:

• it doesn't require users to install the VC runtime among the 30 possible versions in order for games to not crash at launch because a dll isn't found
• users aren't aware about security and won't download the dll from Microsoft's site; instead, they will google search it and will very most likely download it from a malware website which modified the dll, it's a fairly classic vector of attack
• you don't have to do customer support in case the dll is missing from the system and the redist installer didn't fire for some reason

[tuket]

Makes sense. It would be cool to allow for it, yes.
I don't know if it it could be interesting for other platforms as well.

[ThomasFOG]

The C runtime is managed quite differently on macOS and Linux, it is strongly discouraged to statically link it on these platforms. On those systems, it is managed by the system itself, which guarantees forward-compatibility and is something that users will likely never have to care about or modify by themselves.

It's mostly a Windows thing, where C runtime is the responsibility of the developers and apps themselves. Microsoft is vaguely trying to clean this up to avoid users from grabbing dlls from anywhere, but we still have 20 years of internet history and malware sites more visible and with better SEO than Microsoft's own website.