> I'm volunteering to drive the coordination work for a paper framing the requirements for a specification that would allow package managers and build systems to communicate on how to consume a prebuilt library.

The set of configuration parameters (compile flags, build options of
libraries) which can affect ABI, cause ODR issues and in general cause
IFNDR issues is unbounded and any solution which tries to encode the
complete information is bound to fail. A "something is better than
nothing" approach is even worse because it givens a false illusion of
correctness, but even worse, gives us tools (package managers) which
are built on that illusion of correctness. For example, the tool that
does not take into account the ABI is effectively assuming that all
different compiled versions will be ABI compatible. The effect then is
that programmers have to worry about whether their code breaks ABI or
not. And while there is a time and place to think whether a code
breaks ABI or not, it should not be happen because of limitations of
package manager.

During the build process of the dependencies, only the package manager
can be aware of whether two installed packages are compatible or not.
As soon as the package is built, an unbounded amount of information
about compilation is lost, and therefore, it is then technically
impossible for a build system to then independently verify for itself
whether the dependency it is looking at is compatible with the
software the build system is trying to build.

In that respect, in my opinion, the only things that you can reliably
specify as parameters passed from package manager to build system are
paths to packages (include paths, linker paths, binary paths for code
generator executables, cmake_prefix_paths, path to search for
pkg-config files). Everything else, including the the specific link
flag to use `-lmylib` for example, and the actual include flag to use
`-isystemmylib` for example should be determined by the build system
by looking in the path specified by the package manager. And then it
is the responsbility of the package manager to specify the correct
paths to ensure that the packages provided are appropriate for the
purpose.

-- 
Best
Jayesh Badwaik