4 ms·
I know it is not always possible but forking the repos helps mitigate the issue of original repo being "compromised". It also helps reproducible builds...
by hamdouni 3y ago
I know it is not always possible but forking the repos helps mitigate the issue of original repo being "compromised". It also helps reproducible builds...
- janosdebugs 3y agoYou don't need to do that with Go, go.sum stores the checksums and you can use go mod vendor to download the dependencies to your own repo.
- hamdouni 3y agoThat is not the point. If I newly checkout my Go project and build it, it will use my forked repos instead of the orginal ones. If someone use my project, it will also use my forked repos, so it makes the builds more reproducible. That way, I'm not pushing the dependencies in my project.
- DaiPlusPlus 3y agoBut then you end up with a 50GB+ npm /node_modules/-type situation. No thanks.
- hamdouni 3y agoSorry, I don't understand. My proposition is only to change 'origibal/dependency' to 'myfork/dependency'.
- hamdouni 3y agoBy forking the dependencies, I meant having a copy of them in my namespace, not cloning them in my project...