4 ms·
I am a minority I feel but everywhere I have ever worked I have always pushed to keep your dependencies close. There was never a way to reproduce a build withou
by tonetheman 8y ago
I am a minority I feel but everywhere I have ever worked I have always pushed to keep your dependencies close. There was never a way to reproduce a build without doing so.
I know other smart people want badly to trust in outside sources ... but I am old and jaded.
And never skipped a build because npm was down... or before that if I could get a jar from a remote source ... and so on.
- lstamour 8y agoBazel encourages you to list geographically diverse sources to download from for workspace setup. That said, you could run a local proxy with something like Squid or Varnish, turn on caching in a remote build server, or set up a mono-repo and never use npm (as Google does), each has advantages and tradeoffs... you could also archive and backup your Bazel folders to hermetically reproduce workspaces and builds if patching is necessary, though you’d have to also archive a copy of your host or build environment if you’re paranoid about host tools or configurations changing.
- habitue 8y agoVendoring is totally a thing you can do, but keeping them up to date with upstream (and keeping your bazel BUILD files current) is a full time job. You have to hire someone to do that work, it's not completely automatable.
- vageli 8y agoNon-security upgrades probably _shouldn't_ be automated.
- habitue 8y agoAbsolutely agree. But I meant maintaining BUILD files for code you didn't write can be very time consuming. Even a security-only update can include new source files that you now have to tell Bazel about. It's real work