2 ms·
Pinning isn't enough. People push history changes, rename things and just delete stuff all the time. I've had this happen to be more than once and would now nev
by eikenberry 9y ago
Pinning isn't enough. People push history changes, rename things and just delete stuff all the time. I've had this happen to be more than once and would now never consider a application production ready until all dependencies are either vendored or forked.
- jitl 9y agoThere are plenty of strategies for making your dependencies deterministic. At Airbnb, we use caching proxies in front of all third-party language package managers, so the first time someone in the org pulls “foo 1.2.3”, the source tarball is frozen forever. The package can’t be yanked upstream, force-pushed over, etc.