3 ms·
> this is a better solution than plain submodules, for many reasons; Transitive dependencies, diamond dependencies, semantic versionion, can't forget to submodu
by Boulth 8y ago
> this is a better solution than plain submodules, for many reasons; Transitive dependencies, diamond dependencies, semantic versionion, can't forget to submodule update --recursive, etc, etc.
Well, one could argue that diamond dependencies are just bad design, transitive dependencies are just submodules of submodules, leading to conclusion that using submodules is like pinning entire dependency tree to a particular commit. So for a given commit there is only one way to download entire tree that is cryptographically secure, without trusting third parties.
I still wouldn't recommend submodules if your build system have packages but it's an interesting idea nonetheless.
- Too 8y agoIf I depend on library A and B which both depend on the standard library, I have a diamond dependency. How is that bad design?
- Boulth 8y agoStandard library is usually an implicit dependency. Which package manager makes you explicitly name and version std lib?
- chriswarbo 8y agoCabal is one example, which requires packages like `base` to be specified explicitly. Cabal runs a dependency solver to satisfy most dependencies, but for compiler-provided things like `base` it simply checks whether or not the requirement is satisfied by the compiler being used (if not, it bails out).