Nine bundled CLIs, zero static links: an OpenSSL CVE becomes a file copy, and the parser is the bill

The mechanism worth copying here is how little the host program knows. The C++ layer builds an argument list, calls CreateProcess, reads stdout and wraps it as JSON, and it has no idea what `-gravity southeast` or `sm4-cbc` means; it passes the algorithm name straight through ^[3]. That ignorance is what makes the feature work cheap: adding a hash algorithm is a line in the front-end's ALGORITHMS list plus a docs update, with no change to the native API, and the author says sm2, sm3 and sm4 were covered in a day on that basis ^[9].

The knowledge has to live somewhere, and it moved into the output parsers. CLIs emit text written for humans, so each one got a hand-rolled parser that can break when the tool changes its output format ^[12]. With nine bundled engines ^[1], that is up to nine output contracts owned by one maintainer ^[20]. The author's own example of the friction is `openssl enc`, whose output he calls a mess to parse, against `gh` and `kubectl`, which will emit JSON if asked ^[14].

The latency arithmetic is where the pattern stops being free. A spawn costs tens of milliseconds, which he calls fine for hashing a file and brutal for verifying 10,000 HMACs in a loop ^[10]. Take him literally: at 10 to 50 ms per spawn, that loop burns 100 to 500 seconds on process creation alone, before any cryptography runs ^[19]. Streaming has a second bill, because bytes now cross a process boundary, and he concedes you feel it on a 4GB ISO and would not build a backup service this way ^[11].

Some of what he gets back is genuinely free. Nine tools that each want to own `inflate` or their own OpenSSL keep their dependencies inside their own process, so the symbol collisions of a fat static binary never arise ^[6]. A misbehaving ffmpeg.exe exits non-zero and is wrapped as an error while the main process survives ^[8]. Auditing what version is actually live is `openssl version`, not symbol archaeology ^[7]. What is not free is lifecycle code he would never have written for a function call: timeouts, zombie handling and cancellation, plus a work queue with concurrency limits so that 200 images do not become 200 concurrent magick.exe processes ^[15].

The line he draws is the useful part of the writeup, because it is drawn against his own architecture. High throughput, large streaming I/O and unstable CLI output are listed as the conditions under which the pattern fails ^[17], and he says that for a media server or a crypto API gateway he would static-link, calling the choice frequency-dependent ^[18]. That is the test to apply before borrowing this: not whether subprocesses feel clean, but how many times per second you call them.