3 ms·

> Have you ever had a build fail because of a network error on some third-party server? Commit your dependencies and that will never happen. And here is the tr

by o11c 3y ago

> Have you ever had a build fail because of a network error on some third-party server? Commit your dependencies and that will never happen. And here is the true root of the problem - people use build systems as if they were package managers. Use a real package manager (and install your dependencies before the build) and suddenly it is clear why dependencies do not, in fact, belong in version control.

api 3y ago
If you mean an OS package manager, now your dependencies are all really old and you have only one version to choose from. There’s a reason Rust and Go built their own dependency fetching systems and other languages like Java has had them for years.
- reactordev 3y ago
  And you should use them instead of checking in Jar files into your repo…
  - api 3y ago
    So your builds fail if a remote site goes down, and the speed of that site rate limits your CI.
    - reactordev 3y ago
      Nexus/Artifactory my friend. If your site is down, you have bigger issues on your hands. If the remote end is down, cache is there to save you.
- shortrounddev2 3y ago
  vcpkg is really awesome, but the versioning system has something to be desired
gravypod 3y ago
I don't think a package manager solves this case. If you own a repo with software in it you'll make sure to back up everything in that repo. If part of the build of your code in your repo fetches something from the network that will eventually fail and you will no longer be able to build your software again. I recently had someone ping me for a build of software that I wrote >10years ago. I couldn't build the code in the repo since I didn't contain the deps in my repo and the servers my build scripts reached out to where down.
- amluto 3y ago
  It’s worse than just that. Say I pick Fedora as my base. Now my project is a pile of SRPMs, that need a nasty bootstrap to build (okay, this is hard to avoid), and I’m stuck using the Fedora build system. Which sucks, sorry. (Okay, at least there is only one Fedora build system.) Also a whole OS is dragged along. If I want to edit a dependency, eww, I have to commit patch files and muck with .spec files. Good times. Good tooling like the author describes could exist. No distro I’ve ever used is it. Gentoo is probably closer than Fedora, as Gentoo is actually intended to build packages as opposed to just running them.

by o11c 3y ago

api 3y ago

If you mean an OS package manager, now your dependencies are all really old and you have only one version to choose from. There’s a reason Rust and Go built their own dependency fetching systems and other languages like Java has had them for years.

reactordev 3y ago
And you should use them instead of checking in Jar files into your repo…
- api 3y ago
  So your builds fail if a remote site goes down, and the speed of that site rate limits your CI.
  - reactordev 3y ago
    Nexus/Artifactory my friend. If your site is down, you have bigger issues on your hands. If the remote end is down, cache is there to save you.
shortrounddev2 3y ago
vcpkg is really awesome, but the versioning system has something to be desired

gravypod 3y ago

I don't think a package manager solves this case. If you own a repo with software in it you'll make sure to back up everything in that repo. If part of the build of your code in your repo fetches something from the network that will eventually fail and you will no longer be able to build your software again. I recently had someone ping me for a build of software that I wrote >10years ago. I couldn't build the code in the repo since I didn't contain the deps in my repo and the servers my build scripts reached out to where down.

amluto 3y ago
It’s worse than just that. Say I pick Fedora as my base. Now my project is a pile of SRPMs, that need a nasty bootstrap to build (okay, this is hard to avoid), and I’m stuck using the Fedora build system. Which sucks, sorry. (Okay, at least there is only one Fedora build system.) Also a whole OS is dragged along. If I want to edit a dependency, eww, I have to commit patch files and muck with .spec files. Good times. Good tooling like the author describes could exist. No distro I’ve ever used is it. Gentoo is probably closer than Fedora, as Gentoo is actually intended to build packages as opposed to just running them.