Dependency management in ROS2: CMakeLists.txt, package.xml, colcon build, make ...?

edit

dependencies are added using <depend> tags in package.xml. But for building the code, cmake's find_package() is used?

In order to be able to automate packaging as well as determine inter-package dependencies those need to be declared in a machine readable format. That is why they are present in the manifest files package.xml.

In CMake you need to find other packages. If the names of your build dependency names align perfectly with the names of the CMake config files you might be able to use convenience functions like ament_auto_find_build_dependencies. But in reality there are often mismatches between rosdep key names (the ones in the package.xml file) and the CMake config name. Therefore it is very common for them to be reiterated in CMake.

And what benefit is colcon build adding here, can't I just build the package using make?

Any ROS package (which in ROS 2 could any build system like CMake, Python setuptools, etc.) can be build using its native build tool. So yes, you can invoke just cmake && make && make install on a ROS package using CMake (even if it uses ament_cmake or in ROS 1 catkin).

The "problem" with this approach is scalability. First, if you want to build multiple packages you need to manually determine in which order you need to build them. Second, if you want to build more than one package it will require a lot of manual labor. Pretty much all colcon is doing for you is figuring out the dependency graph and invoke the necessary commands to build each package based on the build system it uses (while also leveraging parallelism where possible to speed up the process).

According to its package.xml file it requires - among others - the package camera_info_manager. How do I install it? Does ROS2 ship with a package manager that allows installation of package from remote source?

If there are binary packages for the platform you are interested in (e.g. Ubuntu) you can install those. E.g. for Ubuntu we create debs which you can install using apt. For Windows Microsoft builds chocolatey packages which you can install with choco. So ROS uses existing package managers rather than inviting its own.

Beside that you can always build dependencies from source if either binary packages aren't available on your platform or you want a different version. When adding one dependency to your workspace it might require additional recursive dependencies. rosinstall_generator is a tool which helps you to get the source of all recursive dependencies so that you can build them from source.