Description:
------------
It is a lot more cumbersome for distros to create packages for bundled software especially from a QA and security standpoint.  The security standpoint stands out the most because modified bundled libraries have not been fully vetted by software security teams and their vulnerabilities can easily be leveraged by attackers if the bundled library is older and contains known vulnerabilities or if the internal modifications to them create vulnerabilities.

It is better not to bundle unrar and use the actual unrar library that is provided by rarlabs.  According to the README, some modifications were made to this bundled library:

"Some modifications have been applied to the UnRAR library, mainly to allow
streaming extraction of files without using threads."

Is there any reason why hese changes cannot be committed upstream and turned on/off using a configure flag so that you don't have to bundle this library?


Expected result:
----------------
package should depend on unrar library with needed patches pushed upstream.

Actual result:
--------------
package bundles unrar