3 ms·
Is there some way to build a cargo vendor --aggressive which might prune all the code from your deps that is "dead" to your crate? Would it make the "review
by jcgrillo 3y ago
Is there some way to build a
cargo vendor --aggressive
which might prune all the code from your deps that is "dead" to your crate? Would it make the "review your deps" problem more tractable? This is a tangent to the article, but related in that ultimately we're responsible for our choice of dependencies and all that entails. It seems like there might be room for tooling to help us better take responsibility for what actually gets compiled into our crates.
- remram 3y agoDo you also go and copy all the bug reports from the library into your own bug tracker? If not, what is the improvement?
- jcgrillo 3y agoThe improvement is (possibly) that not every line of every dependency in the graph actually gets compiled into my artifact. What I want is a tool which trims down my dependencies to just those lines of code which actually end up in my binary. That way I don't actually have to care about (again possibly) most of those bug reports, because they might not have anything to do with the pieces of each dependency I actually depend on. Basically I want something which eliminates all the dead code in my dependency graph, and makes me review the diff in the undead code every time the dependency graph changes, my code changes, or both. Otherwise I'm very unlikely to review my deps and their usage. If it doesn't appear as an actual diff in code review it's not getting reviewed, probably.