3 ms·

> I don't want anything in my Rust dependency tree depending on node packages. This is not what they’re arguing for. > Custom builds, cross compiling, codegen

• echelon 3y ago
  > That’s great, none of that is “package management”. Tight coupling matters. > Could that piece be made generic? Semver has different meanings to different languages based on compiler versions. Some languages want 100% build reproducibility and hermeticity, and some languages will never get there. Some languages permit yanking. Some languages allow binary distributions. ... These decisions go very deep to the fundamental ethos of the languages themselves. I don't think we'd find any agreement.
• nijave 3y ago
  Some languages do all kinds of arbitrary things during package installation so the lowest common denominator is "the package manager can execute arbitrary code that does anything" unless languages change their designs to something more restrictive. Python is an example of a language that can (and historically has) done arbitrary things in package installation https://stackoverflow.com/a/43350802/2751619 https://stackoverflow.com/a/43350802/2751619 I think things have improved, but you didn't used to be able to build a dependency tree without installing all packages and iirc there was a dependency resolution case where pip would download every version counting backwards until one happened to install