3 ms·
If you work on a non-open-source project using libraries from open-source projects, you should always: 1. have the ability to rebuild everything from your own
by dsr_ 6y ago
If you work on a non-open-source project using libraries from open-source projects, you should always:
1. have the ability to rebuild everything from your own repo, without requiring an external source to be available.
2. Specify versions of every library, preferably with a hash of their contents in some form, that gets checked at build time.
3. Subscribe to the serious bugs, announce, security, and/or major release lists for each library, so that you know when something big is happening.
4. Keep old versions that you used.
5. Update to new versions only when you have an expressible need.
Every bit of software has a cost. Sometimes that cost is in dollars, sometimes in reciprocity, and always in awareness.
- JohnBooty 6y agoRight - those are the goals and they are crucial ones. I was thinking "best practices" in terms of, well, practice. The implementation of things to achieve those goals. The most obvious thing one could do in Ruby land is to vendor one's gem dependencies with bundler, but I'm not sure how that works in conjunction with a typical git-based workflow.