4 ms·
> Maybe published package versions should be immutable. They are in many languages. Of those I'm familiar with, Raku, Rust, and JavaScript all have immutable
by codesections 5y ago
> Maybe published package versions should be immutable.
They are in many languages. Of those I'm familiar with, Raku, Rust, and JavaScript all have immutable package repos. (npm wasn't when left-pad was pulled but has changed since then).
Of course, in each case they're only "immutable" in the sense that some organization (with varying degrees of centralization) has promised to host them forever; people clearly vary in their willingness to believe promises of that nature.
- DarylZero 5y agoHaskell's Stack and Nix have immutable repositories in a more technical sense: you can specify the entire set of dependencies using cryptographic hashes of their contents.
- iudqnolq 5y agoOther package managers also store hashes, just separately in lock files. The main issue is a takedown for legal or administrative reasons. If you have a hash that might possibly be helpful in searching for an alternative source after a takedown, but it's not that much protection