4 ms·

OP here. > Your proposal is not new. Good thing I never claimed it was? I merely claimed it was "the right thing". I'm exceedingly familiar with vcpkg. And m

OP here. > Your proposal is not new. Good thing I never claimed it was? I merely claimed it was "the right thing". I'm exceedingly familiar with vcpkg. And many other package managers in many other languages. Some good (Rust Cargo) and some bad (Python pip/Conda). Have you ever worked in a repo that committed all of its dependencies? I have. It's quite nice! Maybe you should have an open mind and come back to us when you've tried the other side.

reactordev 3y ago
I don't want to download 3TB of dependencies from git. What is your gripe with vcpkg? What short-comings does it have? Do you need to keep archives of your dependencies? That's an IT problem. I simply don't agree that it's "The Right Thing". The only thing that is right is making sure you can build. Whether that's pulling dependencies from the internet. Pulling dependencies from your OS. Or Pulling dependencies off a USB stick authorized by the government for use in the clean room you must build and install the software into? I don't want a world where 1 CVE requires 100,000 commits to all the repo's of the world. I want one where 1 CVE requires 1 commit to 1 repo and everyone else get's their share. Bifurcating your software out of the gate is not a sound software development strategy. It's just laziness. If you need to build on 10 year old hardware, you can checkout 10 year old Linux. You can build for 10 year old windows. You can build for 10 year old Mac (time limiting...). You can build Win 3.1 apps today with vcpkg. Storage is cheap. Maybe not so much on Github, but Github isn't the only place you can run git. I've worked at organizations that archived and kept every build, every dependency, every configuration, for every version, since the inception of the software project. Nowhere in the repo is all of that information.
- deleted 3y ago
  [deleted]
- forrestthewoods 3y ago
  > I don't want to download 3TB of dependencies from git. Oh you didn’t read the post. Got it.
  - reactordev 3y ago
    I beg your pardon but I did read it and your argument is flawed. All of it comes down to the fact that you don’t want to spend step 0 configuring your build environment and I completely agree with that statement. What I don’t agree with is you jumping to conclusions about its VCS’s fault. It’s not. It’s C++’s fault. C/C++ needs to be opinionated to keep people on the rails, otherwise you end up in autoconfigure hell. CMake is the most widely adopted build processor, GCC or CLang, don’t chose but let the toolchain decide. If you have specific reasons for clang over gcc or whatever than that responsibility is up to you. Don’t go preaching VCS anti patterns because you can’t make -j8 on first clone. You simply can’t just download a zip of master, with all of the dependencies, disconnect from the internet, and hit build. You don’t have enough disk space. I’d LOVE to see you try doing that on an embedded environment.
    - cxr 3y ago
      > You simply can’t just download a zip of master, with all of the dependencies, disconnect from the internet, and hit build. You don’t have enough disk space. I’d LOVE to see you try doing that on an embedded environment. Huh? What does this have to do with anything? It looks like you just moved the goalposts, hard.
    - forrestthewoods 3y ago
      We agree that it is good to not force every user to spend time configuring their build environment. That’s a start! I propose solving this problem by storing the necessary environment components in VCS. This eliminates the vast majority of environment setup issues. Many many many companies do exactly what I propose. It works great. The primary reason that more projects don’t use this approach, imho, is because Git doesn’t have the necessary features. Other VCS tools do, Git does not. I think it would be good to have a popular VCS tool, Git or otherwise, with this capability. > You don’t have enough disk space. Sure I do. Downloading dependencies from a package manager or downloading dependencies from VCS requires the exact same amount of disk space. The nice thing about VCS is it works for all platforms, for all languages, for all dependencies.

reactordev 3y ago

I don't want to download 3TB of dependencies from git. What is your gripe with vcpkg? What short-comings does it have? Do you need to keep archives of your dependencies? That's an IT problem. I simply don't agree that it's "The Right Thing". The only thing that is right is making sure you can build. Whether that's pulling dependencies from the internet. Pulling dependencies from your OS. Or Pulling dependencies off a USB stick authorized by the government for use in the clean room you must build and install the software into? I don't want a world where 1 CVE requires 100,000 commits to all the repo's of the world. I want one where 1 CVE requires 1 commit to 1 repo and everyone else get's their share. Bifurcating your software out of the gate is not a sound software development strategy. It's just laziness. If you need to build on 10 year old hardware, you can checkout 10 year old Linux. You can build for 10 year old windows. You can build for 10 year old Mac (time limiting...). You can build Win 3.1 apps today with vcpkg. Storage is cheap. Maybe not so much on Github, but Github isn't the only place you can run git. I've worked at organizations that archived and kept every build, every dependency, every configuration, for every version, since the inception of the software project. Nowhere in the repo is all of that information.

deleted 3y ago
[deleted]
forrestthewoods 3y ago
> I don't want to download 3TB of dependencies from git. Oh you didn’t read the post. Got it.
- reactordev 3y ago
  I beg your pardon but I did read it and your argument is flawed. All of it comes down to the fact that you don’t want to spend step 0 configuring your build environment and I completely agree with that statement. What I don’t agree with is you jumping to conclusions about its VCS’s fault. It’s not. It’s C++’s fault. C/C++ needs to be opinionated to keep people on the rails, otherwise you end up in autoconfigure hell. CMake is the most widely adopted build processor, GCC or CLang, don’t chose but let the toolchain decide. If you have specific reasons for clang over gcc or whatever than that responsibility is up to you. Don’t go preaching VCS anti patterns because you can’t make -j8 on first clone. You simply can’t just download a zip of master, with all of the dependencies, disconnect from the internet, and hit build. You don’t have enough disk space. I’d LOVE to see you try doing that on an embedded environment.
  - cxr 3y ago
    > You simply can’t just download a zip of master, with all of the dependencies, disconnect from the internet, and hit build. You don’t have enough disk space. I’d LOVE to see you try doing that on an embedded environment. Huh? What does this have to do with anything? It looks like you just moved the goalposts, hard.
  - forrestthewoods 3y ago
    We agree that it is good to not force every user to spend time configuring their build environment. That’s a start! I propose solving this problem by storing the necessary environment components in VCS. This eliminates the vast majority of environment setup issues. Many many many companies do exactly what I propose. It works great. The primary reason that more projects don’t use this approach, imho, is because Git doesn’t have the necessary features. Other VCS tools do, Git does not. I think it would be good to have a popular VCS tool, Git or otherwise, with this capability. > You don’t have enough disk space. Sure I do. Downloading dependencies from a package manager or downloading dependencies from VCS requires the exact same amount of disk space. The nice thing about VCS is it works for all platforms, for all languages, for all dependencies.