3 ms·
I think the point is more that it's completely under your control. The application build would be done however best suits your infrastructure and requirements.
by GrinningFool 10y ago
I think the point is more that it's completely under your control. The application build would be done however best suits your infrastructure and requirements.
Using npm doesn't demonstrate repeatability, but you could just as easily build a given application from fixed, verified source in this step.
- davexunit 10y agoMany (bad) build systems will download stuff from the net and you may not even know it. I've discovered plenty of software like this because I used GNU Guix to build them, which does not allow network access to builds for which the checksum is not known in advance. It's absolutely essential that a package manager constrain the environment in which builds are performed. Without it, the packages are doomed to be built in a nondeterministic manner and potentially tampered with.