Feature request: maximally prefer UCRT libraries over all others in msys2

[ethindp]

I noticed today that when installing the openssl package in msys2, it installed mingw-w64-x86_64-openssl instead of mingw-w64-ucrt-x86_64-openssl. This is a pretty nasty problem, as the MSys2 libraries (which have no prefix) do not use the modern windows CRT and instead use the (very, very old) visual studio 6.0 C runtime, which has a bunch of bugs and introduces weird potential errors like heap allocation errors on systems where ASLR/PIE/PIC is used. I think the strategy that should be used is something like this: if on windows and a system package is required, always prefer the ucrt version unless it doesn't exist, and only then fallback to possible alternatives.

[mosteo]

We don't have a definition of libssl on msys2 (it would be here) so that means that openssl was being installed as a dependency of some other msys2 package (do you remember what you were doing?).

In other words, this is just the default msys2 behavior. Do you know if this is something that can be configured for a given msys2 installation?

[ethindp]

I was setting up utilada_aws/utilada_curl, both of which require it. I don't believe it's necessarily configurable as a default, but I very well could be wrong. I know that some packages get a "mingw-w64-x86_64-" prefix prepended to it so I thought Alire was doing that but maybe it's not?

[mosteo]

Well, Alire do lists some msys2 packages by name in its external definitions, and there we could add the ucrt version. But when these packages bring in other dependencies, it's msys2 using its own dependency management. Although I would expect that the ucrt versions would depend on other ucrt versions, so it may be worth a try.

[Fabien-Chouteau]

@ethindp When we started Msys2 support in Alire, UCRT was a new thing on Msys2, and it wasn't clear to me what the difference was or why one would pick this instead of mingw-w64. Also we are building compiler with mingw so I don't know what the compatibility will be like.

Ideally, we could support both, depending on user preference, but I don't know how much work that would be or what compatibility issues we will have.