3 ms·

> What we really need is for language-level package managers to support signed immutable packages +1 Emphasis on immutable. Can someone explain why popular pac

by whack 9y ago

> What we really need is for language-level package managers to support signed immutable packages +1 Emphasis on immutable. Can someone explain why popular package managers like npm don't offer this? During the leftpad fiasco, it boggled my mind that someone could just "liberate" their packages one morning, and transitively break the build for thousands of projects. Immutable packages would have prevented this entire problem.

AgentME 9y ago
NPM fixed that situation by no longer allowing packages to be unpublished after 24 hours. NPM does not allow packages to republish new content under a previously-used version number. NPM by default generates a package-lock.json file (separate from package.json) which pins the versions of all dependencies (including transitive ones) and includes the hashes of the dependencies, which would protect users if npm's servers ever became malicious.
- oneweekwonder 9y ago
  > NPM by default generates a package-lock.json file Thanks for the tidbit, seen it been added May last year to npm5[0]. Hard to keep up if you don't use the tooling activity and only depend on it for other tooling. [0]: http://blog.npmjs.org/post/161081169345/v500 http://blog.npmjs.org/post/161081169345/v500