3 ms·
It's both a matter of perception and of tooling. Consider the Java ecosystem. Dependency targets are specified by coordinates of both group and artifact, which
by Fellshard 7y ago
It's both a matter of perception and of tooling.
Consider the Java ecosystem. Dependency targets are specified by coordinates of both group and artifact, which satisfies the above separation fairly well, to the best of my knowledge.
Consider the NPM and rubygems ecosystems: they specify dependencies by the name of the library alone, implicitly enforcing the 'authorized artifact' model.
- em-bee 7y agoso you are saying that in java this works because i can choose the group where i get the artifact from, just like i can chose a different package repo for a package for my linux distribution. but in NPM and ruby i am limited to one single global repo and thus have no choice but to get the one that is controlled by whoever owns the name.
- Fellshard 7y agoSimilar, yes. You can also choose repositories in Java, as well, which is closer to your Linux package repo. So there's just another tier in the hierarchy, there, basically. You can run your own private artifact repositories for NPM and Ruby, and select which concrete artifacts they contain; but that's not the publicly hosted repositories. One option could be to centralize into a cluster of public repositories, which is closer to what the Java and Linux ecosystems have, and that may be a sufficient compromise in many cases. I think the layer of abstraction between repositories and concrete artifacts is still useful.