6 ms·

Before it comes up: Bazel ships with its own copy of the JVM so you do not need to install Java to use it.

by adgasf 7y ago

qhwudbebd 7y ago
...if you're happy running random third party binaries instead of building from source.
- adgasf 7y ago
  Do you review all of the source-code that you run? If you trust the source-code due to its origin, why not trust a binary?
  - qhwudbebd 7y ago
    It doesn't matter whether I trust it or not: these binaries are typically linked against a different C library, assume a different filesystem layout and dynamic linker location, and are often only available for x86-64 in any case. I build binaries locally to get something that's marginally more likely to work on my system, rather than because I believe I could somehow catch nasties buried in the source code even if I read every line. Too many years of seeing the ingenuity of IOCCC entries has taught me I won't succeed at that. :)
account42 7y ago
Is this supposed to be a good thing?
- PedroBatista 7y ago
  Probably better than Nodejs Gulp Yo man ugabuga npm here's 3.4 million files for you to download or Python is it 2.7 or 3.1? Pip too and Ansible let's make that terminal a disco night of text! or some Go "Works great for my static file blog" build tool.
  - jsight 7y ago
    You aren't wrong about that. I've lost countless hours to people doing some random thing to get a newer Python version (even if they didn't even need it), only to completely hose both the new one and their system one. And the npm situation is really messy for many people who are new to it.
- danpalmer 7y ago
  Is it a bad thing? That might make the installed size large, but if it's isolated to Bazel, managed by Bazel, updated by Bazel, etc, then why does it matter whether it's a JVM, a Python binary, a JS VM, or anything else?
  - ivankolev 7y ago
    sometimes it is, in Enterprise it's very common to have invasive proxies and just yesterday I was fighting Bazel into using different than the built-in cert store. (it tries to fetch some of its components from github, and that fails if you don't use the proper certs)
  - hannob 7y ago
    > Is it a bad thing? Yes. It makes verifiability much harder. E.g. Debian put a lot of work into making a more trustworthy build chain by introducing reproducible builds. There's no Bazel on Debian. And not on many other distros. Because getting Bazel to be built itself is a complexity nightmare. "Here, download this big blob where you have no idea how it's been built" doesn't exactly help.
    - zerkten 7y ago
      Could the Bazel folks better define the composition of their blob? That way they can distribute their blob, but someone could substitute for another instance of the JVM. I'm assuming ownership of this lies with Bazel and this is more of a political/motivation problem than a technical one. Or, is that incorrect?
      - hannob 7y ago
        Sure, this is not impossible. But there's a simple fact: The more complex your build chain is the more difficult this is. And Java adds a whole bunch of complexity. Read into the bug report to get an idea what a nightmarish task this is: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=782654 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=782654
      - 7y ago
- yk 7y ago
  At some point someone will just bundle all the software into a single docker container, and then we are finally done with the entire installation quagmire.
  - blauditore 7y ago
    You'll still have to install docker first.

Before it comes up: Bazel ships with its own copy of the JVM so you do not need to install Java to use it.

by adgasf 7y ago

Before it comes up: Bazel ships with its own copy of the JVM so you do not need to install Java to use it.

qhwudbebd 7y ago

...if you're happy running random third party binaries instead of building from source.

adgasf 7y ago
Do you review all of the source-code that you run? If you trust the source-code due to its origin, why not trust a binary?
- qhwudbebd 7y ago
  It doesn't matter whether I trust it or not: these binaries are typically linked against a different C library, assume a different filesystem layout and dynamic linker location, and are often only available for x86-64 in any case. I build binaries locally to get something that's marginally more likely to work on my system, rather than because I believe I could somehow catch nasties buried in the source code even if I read every line. Too many years of seeing the ingenuity of IOCCC entries has taught me I won't succeed at that. :)

account42 7y ago

Is this supposed to be a good thing?

PedroBatista 7y ago
Probably better than Nodejs Gulp Yo man ugabuga npm here's 3.4 million files for you to download or Python is it 2.7 or 3.1? Pip too and Ansible let's make that terminal a disco night of text! or some Go "Works great for my static file blog" build tool.
- jsight 7y ago
  You aren't wrong about that. I've lost countless hours to people doing some random thing to get a newer Python version (even if they didn't even need it), only to completely hose both the new one and their system one. And the npm situation is really messy for many people who are new to it.
danpalmer 7y ago
Is it a bad thing? That might make the installed size large, but if it's isolated to Bazel, managed by Bazel, updated by Bazel, etc, then why does it matter whether it's a JVM, a Python binary, a JS VM, or anything else?
- ivankolev 7y ago
  sometimes it is, in Enterprise it's very common to have invasive proxies and just yesterday I was fighting Bazel into using different than the built-in cert store. (it tries to fetch some of its components from github, and that fails if you don't use the proper certs)
- hannob 7y ago
  > Is it a bad thing? Yes. It makes verifiability much harder. E.g. Debian put a lot of work into making a more trustworthy build chain by introducing reproducible builds. There's no Bazel on Debian. And not on many other distros. Because getting Bazel to be built itself is a complexity nightmare. "Here, download this big blob where you have no idea how it's been built" doesn't exactly help.
  - zerkten 7y ago
    Could the Bazel folks better define the composition of their blob? That way they can distribute their blob, but someone could substitute for another instance of the JVM. I'm assuming ownership of this lies with Bazel and this is more of a political/motivation problem than a technical one. Or, is that incorrect?
    - hannob 7y ago
      Sure, this is not impossible. But there's a simple fact: The more complex your build chain is the more difficult this is. And Java adds a whole bunch of complexity. Read into the bug report to get an idea what a nightmarish task this is: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=782654 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=782654
    - 7y ago
yk 7y ago
At some point someone will just bundle all the software into a single docker container, and then we are finally done with the entire installation quagmire.
- blauditore 7y ago
  You'll still have to install docker first.