4 ms·
For Lua, just to be safe, I fork all my dependencies and when I work on a project I add those forked dependencies as git submodules. Just to feel a bit more sec
by wsc981 4y ago
For Lua, just to be safe, I fork all my dependencies and when I work on a project I add those forked dependencies as git submodules. Just to feel a bit more secure any dependencies never disappear.
Not sure if this is good practice.
- doodlesdev 4y agoWith node some people commit the heresy of comitting the whole node_modules folder.
- danielheath 4y agoI would do that, but node puts compiled bits in there, so nothing works if you switch machines. It's not like linux distros figured out this stuff was an issue decades ago...
- projektfu 4y agoI think that's called vendoring and it's part of the 12 factor app.
- pabs3 4y agoIts good to have dependencies archived for continued access to them, but there are efficiency issues with doing that. Using git submodules (or vendoring or similar) means that you and everyone who uses the project is stuck on the exact commit you have chosen for each submodule until they go and modify the git tree to use a different commit for each submodule. This makes it higher friction to update a submodule. You can't just go `git pull` or `apt upgrade` to update the submodule, you actually have to go modify every project that uses the submodule, update and redeploy each one, instead of just updating and redploying the submodule itself.
- dhzhzjsbevs 4y agoThat sounds amazingly slow, in a good way.
- wsc981 4y agoWell, I only use git submodules in private projects. From what I read most devs hate it :) In the past I did came into contact with git submodules through freelancing for another company, and I agree it was quite a hassle it times using it in a team setting.
- pabs3 4y agoEven in private projects, its an additional hurdle that can block things like security updates for example.
- yawaramin 4y agoWhat about transitive dependencies?
- likortera 4y agoIt's forking all the way down. I run my code on a fork of Linux, just in case.
- wsc981 4y agoI've found most Lua libraries don't have any other dependencies. Perhaps this is the reason I've found this approach work well with Lua. I've never tried it with other languages that I use, like Swift, Objective-C, C#. I did work in a company in the past that used Nexus [0] for their dependencies across various platforms. Perhaps Nexus has some tooling build in to deal with transitive dependencies, not sure. --- [0]: https://www.sonatype.com/products/nexus-repository https://www.sonatype.com/products/nexus-repository
- zelphirkalt 4y agoGood luck with that approach in the JS world, where a package can have, without exaggeration, a thousand and more dependencies. Hopefully in the Lua world things are saner.
- wsc981 4y agoI’ve found most Lua game related libraries don’t have any dependencies, so it’s indeed a saner world :)