Correct way to include 3rd party package in OpenSource project

[anse]

What is the correct way to include a 3rd party open-source'd Lazarus package into another OpenSource project repository?
Assuming both are licensed under GPL 2, and hosted on Github.

Of course the readme file of the project should get a mention of that 3rd party package name and author.

Regarding the package code itself, should I either
* add the 3rd party package as a whole to my project repository, (in a subdirectory?)
* or should I just place a reference in the project options (where?)

[Martin_fr]

If it is GPL-2, then legally it should not make a difference.

Of course your project depends on the other. And you probably tested it with a specific version. If you provide a link, then it may fail if the user gets the wrong version.

For that reason Lazarus itself for example includes copies of some 3rd party packages, such as VTV and PascalScript. Also in case of Lazarus they are needed to build, and we need to ship all that is needed to rebuild.

A copy also means you can add your own fixes, if the origin does not add them as fast as you like.


If in your case the dependency is less strict, e.g. something that is run as external tool (like including a git executable), and users don't often need the source to build, then a link may be a good idea.
Or if it is optional, but then again, if the version matters...


Of course if you include it as submodule (and you could do that with a clone, i.e. copy, too) then the submodule will point to the correct version.
Making a clone first means more reliability, if the original is moved. And a clone is easily updated. 
A clone also allows you to add your own fixes if needed (like a copy in a folder would).

---------------
As for maintenance. You probably have it with both solutions.

If you ship a link, then you need to update your code, if new versions of the 3rd party project come out.
If you make a copy, you need to look at least for bug fixes and include them.

[anse]

Thank you Martin, that makes it clearer now. In this case I will then use a copy of the package, and keep an eye on its releases. This will make it easier for others to compile, they don't need to download some extra stuff.

Initially I was thinking lazbuild may be capable of downloading a referenced package automatically, when you use the command line compiler and the .lpi project file. But that is something for the future I guess.