Declare missing dependency on 'git'

[cottsay]

Follow-up to #16

[clalancette]

This one is kind of weird. We don't have a dependency on git for the other places in the codebase that use git-apply (like https://github.com/ros2/tinyxml_vendor/blob/master/package.xml); why is this one different?

[cottsay]

We don't have a dependency on git for the other places in the codebase that use git-apply

This is why this isn't a problem for Ubuntu:
https://github.com/ros-infrastructure/ros_buildfarm/blob/7e1d61fd5fd5608bf85b7db24129aeeb89d5b367/ros_buildfarm/templates/release/deb/binarypkg_task.Dockerfile.em#L58

I haven't gone after tinyxml_vendor because that dependency appears to be satisfied by the system's package on all RedHat platforms, so it doesn't need to build from source. If it did, that one would fail too. Grepping through the ROS 2 codebase, tinyxml_vendor and mimick_vendor are actually the only other packages I can find that are missing this dependency. We do actually declare the dependency on git in foonathan_memory_vendor and rviz_ogre_vendor.

I haven't actually seen this fail on the RPM farm yet because this package hasn't been released for a while, but given that Mimick is failing (ros2/mimick_vendor#16), this package likely will as well.

[cottsay]

I'd like to close on this today, @clalancette, so that I can unblock the RPM builds. If we really want to add git to the list of implicit dependencies, then I'll need to add it to the buildroot in mock along with make and g++. If we go that way, we should probably drop the dependency from other packages so that we're consistent.

[nuclearsandwich]

In general I disagree with implicit dependencies so I'm in favor of this change.

[clalancette]

All right, I'm fine with making this an explicit dependency for now.

Orthogonally, but relatedly, we should probably review how we are vendoring packages. We have some combination of:

• Using system packages (via apt, homebrew, chocolatey) - examples include asio, libxml2, iconv, zlib
• Using system packages with vendor override - examples include console_bridge
• Vendoring by pointing to a specific upstream github repository, then applying patches - examples include uncrustify, mimick
• Vendoring by forking the upstream repository, applying our own patches, then cloning the repository via ros2.repos - examples include googletest, googlebenchmark

It would be nice to reduce the number of ways we do this, but I guess that is a problem for another day. I'll go ahead and merge this.