5 ms·

Could someone explain what is meant by “vendoring”?

jrockway 6y ago
Vendoring is when you just copy the dependencies into your own source tree, like in a third_party directory. Personally, I'm a big fan of just taking what you need. A little copying is better than a little dependency[1]. [1] https://www.youtube.com/watch?v=PAAkCSZUG1c&t=9m28s https://www.youtube.com/watch?v=PAAkCSZUG1c&t=9m28s
deleted 6y ago
[deleted]
Ericson2314 6y ago
It's one a package contains it's dependencies, and often their dependencies too (transitive deps).' packages are supposed to be nodes in a dependency graph (or better, partial order), and there are nice composition rules. But one the nodes themselves represent graph/order closures (or almost-closure) we use that nice property. People that are very application oriented tend to like vendoring --- "my application is its own island, who gives a shit". But the distro's point isn't just gather the software --- that's an anachronism --- but plan a coherent whole. And applications who only care about themselves are terrible for that. The larger point is free and open source software really should be library-first. Siloed Applicationns are a terrible UI and holdover from the economics of proprietary shrink-wrapped software which itself is a skeuomorphism from the physical world of nonreplicable goods.
- dragonwriter 6y ago
  > Siloed Applicationns are a terrible UI and holdover from the economics of proprietary shrink-wrapped software which itself is a skeuomorphism from the physical world of nonreplicable goods Siloed applications are UI neutral and represent decoupling, which enables progress and resilience. Excessive interdependence is how you lose Google Reader because other services have changed requirements.
  - Ericson2314 6y ago
    What? Getting rid of Google Reader was a business decision. > Siloed applications are UI neutral and represent decoupling, which enables progress and resilience. The medieval manorial economy is resilient. Is that progress? What happened to unified look and feel? and rich interactions between widgets? The smalltalk and Oberon GUI visions? All that requires more integration. I get that we need to make the here and no work, but that is done via the en-mass translation of language-specific package manager packages to distro packages (static or shared, don't care), not vendoring.
    - dragonwriter 6y ago
      > What? Getting rid of Google Reader was a business decision It has been widely reported that a significant factor in that business decisions was Google’s massively coupled codebase and the fact that Reader had dependencies on parts of it that were going to have breaking changes to support other services. > The medieval manorial economy is resilient. It’s not, compared to capitalist and modern mixed economies, and unnecessary and counterproductive coupling between unrelated functions is a problem there, too. > Is that progress? Compared to its immediate precedents, generally, yes.
- sagichmal 6y ago
  Fewer and fewer people are interested in the benefits provided by "coherent whole" distributions. And more and more people are interested in the benefits provided by "it's own island" applications. The future is statically linked and isolated applications. Distros need to adapt.
  - Ericson2314 6y ago
    Nope. 1. Have the users been asking for everything to be a laggy electron app? I don't think so. 2. Within these apps are languages based package managers that don't encorage vendoring, it's just one people go to package for distros that they vendor away. Distros do need to make it easier to automatically convert language-specific package manager apps. The future is making development builds and production builds not wildly different, and both super incremental, so one can easily edit any dependency not matter how deep and then put their system back to together. Again, I am fine with static linking. My distro, NixOS is actually great at that and I've helped work on it. But vendoring ruins everything. I hate waiting for everyone to build the same shit over and over again with no instrumentality, and I don't have time to reverse-engineer whatever special snowflake incremental dev build setup each package uses.
    - sagichmal 6y ago
      The number of people who consider the system/distribution the atomic unit rather than the application, is probably about equal to the number of people who "edit dependencies and put their system back together" -- they are in total statistically zero. The overriding concern is the user need for a working application. Everything else is a distant secondary concern. I'm not trying to convince you of anything, here, I'm just describing the facts on the ground. If you're not into them, that's fine!
      - Ericson2314 6y ago
        The number of people who have a "theory of distribution" one way or the other is pretty low. But - many people seem to like unified look and feel - many people complain about per-app auto-update - many people love to complain software is getting worse Are these people connecting these complaints to the debate we're having? Probably not. Can these views be connected to that? Absolutely. --- I work on distros and due edit the root dependencies, I also contribute to many libraries I use at work during work, finally, I use the same distro at work on on my own and everything is packaged the same way. So yes, it's a "unified workflow for yak shaves" and I quite like it. I hope there can be more people like me if this stuff weren't so obnoxiously difficult.
- CRConrad 6y ago
  > packages are supposed to be nodes in a dependency graph (or better, partial order), and there are nice composition rules. But one the nodes themselves represent graph/order closures (or almost-closure) we use that nice property. A) "Lose", not "use", right? B) Sounds like a lot of gobbledy-gook... Who cares about this? C) Why should I? > People that are very application oriented tend to like vendoring --- "my application is its own island, who gives a shit". No, people that are very application oriented tend to like applications that work without a lot of faffing around with "dependencies" and shit they may not even know what it means. > But the distro's point isn't just gather the software --- that's an anachronism --- but plan a coherent whole. A) Sez who? B) Seems to me it would be both easier and more robust to build "a coherent whole" from bits that each work on their own than from ones that depend on each other and further other ones in some (huge bunch of) complex relationship(s). > And applications who only care about themselves are terrible for that. As per point B) above, seems to me it's exactly the other way around. > The larger point is free and open source software really should be library-first. Again, sez who? > Siloed Applicationns are a terrible UI WTF does the UI have to do with anything? > and holdover from the economics of proprietary shrink-wrapped software [Citation needed] > which itself is a skeuomorphism from the physical world of nonreplicable goods. Shrink-wrapped diskettes or CDs are physical goods, so they can't be skeumorphic.

Vendoring is when you just copy the dependencies into your own source tree, like in a third_party directory. Personally, I'm a big fan of just taking what you need. A little copying is better than a little dependency[1]. [1] https://www.youtube.com/watch?v=PAAkCSZUG1c&t=9m28s https://www.youtube.com/watch?v=PAAkCSZUG1c&t=9m28s

deleted 6y ago

[deleted]

Ericson2314 6y ago

It's one a package contains it's dependencies, and often their dependencies too (transitive deps).' packages are supposed to be nodes in a dependency graph (or better, partial order), and there are nice composition rules. But one the nodes themselves represent graph/order closures (or almost-closure) we use that nice property. People that are very application oriented tend to like vendoring --- "my application is its own island, who gives a shit". But the distro's point isn't just gather the software --- that's an anachronism --- but plan a coherent whole. And applications who only care about themselves are terrible for that. The larger point is free and open source software really should be library-first. Siloed Applicationns are a terrible UI and holdover from the economics of proprietary shrink-wrapped software which itself is a skeuomorphism from the physical world of nonreplicable goods.

dragonwriter 6y ago
> Siloed Applicationns are a terrible UI and holdover from the economics of proprietary shrink-wrapped software which itself is a skeuomorphism from the physical world of nonreplicable goods Siloed applications are UI neutral and represent decoupling, which enables progress and resilience. Excessive interdependence is how you lose Google Reader because other services have changed requirements.
- Ericson2314 6y ago
  What? Getting rid of Google Reader was a business decision. > Siloed applications are UI neutral and represent decoupling, which enables progress and resilience. The medieval manorial economy is resilient. Is that progress? What happened to unified look and feel? and rich interactions between widgets? The smalltalk and Oberon GUI visions? All that requires more integration. I get that we need to make the here and no work, but that is done via the en-mass translation of language-specific package manager packages to distro packages (static or shared, don't care), not vendoring.
  - dragonwriter 6y ago
    > What? Getting rid of Google Reader was a business decision It has been widely reported that a significant factor in that business decisions was Google’s massively coupled codebase and the fact that Reader had dependencies on parts of it that were going to have breaking changes to support other services. > The medieval manorial economy is resilient. It’s not, compared to capitalist and modern mixed economies, and unnecessary and counterproductive coupling between unrelated functions is a problem there, too. > Is that progress? Compared to its immediate precedents, generally, yes.
sagichmal 6y ago
Fewer and fewer people are interested in the benefits provided by "coherent whole" distributions. And more and more people are interested in the benefits provided by "it's own island" applications. The future is statically linked and isolated applications. Distros need to adapt.
- Ericson2314 6y ago
  Nope. 1. Have the users been asking for everything to be a laggy electron app? I don't think so. 2. Within these apps are languages based package managers that don't encorage vendoring, it's just one people go to package for distros that they vendor away. Distros do need to make it easier to automatically convert language-specific package manager apps. The future is making development builds and production builds not wildly different, and both super incremental, so one can easily edit any dependency not matter how deep and then put their system back to together. Again, I am fine with static linking. My distro, NixOS is actually great at that and I've helped work on it. But vendoring ruins everything. I hate waiting for everyone to build the same shit over and over again with no instrumentality, and I don't have time to reverse-engineer whatever special snowflake incremental dev build setup each package uses.
  - sagichmal 6y ago
    The number of people who consider the system/distribution the atomic unit rather than the application, is probably about equal to the number of people who "edit dependencies and put their system back together" -- they are in total statistically zero. The overriding concern is the user need for a working application. Everything else is a distant secondary concern. I'm not trying to convince you of anything, here, I'm just describing the facts on the ground. If you're not into them, that's fine!
    - Ericson2314 6y ago
      The number of people who have a "theory of distribution" one way or the other is pretty low. But - many people seem to like unified look and feel - many people complain about per-app auto-update - many people love to complain software is getting worse Are these people connecting these complaints to the debate we're having? Probably not. Can these views be connected to that? Absolutely. --- I work on distros and due edit the root dependencies, I also contribute to many libraries I use at work during work, finally, I use the same distro at work on on my own and everything is packaged the same way. So yes, it's a "unified workflow for yak shaves" and I quite like it. I hope there can be more people like me if this stuff weren't so obnoxiously difficult.
CRConrad 6y ago
> packages are supposed to be nodes in a dependency graph (or better, partial order), and there are nice composition rules. But one the nodes themselves represent graph/order closures (or almost-closure) we use that nice property. A) "Lose", not "use", right? B) Sounds like a lot of gobbledy-gook... Who cares about this? C) Why should I? > People that are very application oriented tend to like vendoring --- "my application is its own island, who gives a shit". No, people that are very application oriented tend to like applications that work without a lot of faffing around with "dependencies" and shit they may not even know what it means. > But the distro's point isn't just gather the software --- that's an anachronism --- but plan a coherent whole. A) Sez who? B) Seems to me it would be both easier and more robust to build "a coherent whole" from bits that each work on their own than from ones that depend on each other and further other ones in some (huge bunch of) complex relationship(s). > And applications who only care about themselves are terrible for that. As per point B) above, seems to me it's exactly the other way around. > The larger point is free and open source software really should be library-first. Again, sez who? > Siloed Applicationns are a terrible UI WTF does the UI have to do with anything? > and holdover from the economics of proprietary shrink-wrapped software [Citation needed] > which itself is a skeuomorphism from the physical world of nonreplicable goods. Shrink-wrapped diskettes or CDs are physical goods, so they can't be skeumorphic.