3 ms·
Or you vendor everything. You don't automatically download anything at build or install time, you just update your local source copies when you want to. Which
by Brian_K_White 3y ago
Or you vendor everything.
You don't automatically download anything at build or install time, you just update your local source copies when you want to. Which to be clear I know means rarely.
It's 1970 all over again!
- mrcus 3y agoYes, but this doesn’t prevent issues like the xz issue, where the code looks fine, but the build scripts alter it.
- dmarto 3y agoVendoring is nice, and I usually prefer it, but you don't always have the time or people for it. Vendoring + custom build system (Bazel?) for everything is basically googles approach, if what I have read is correct. Definitely better than everything we have, but the resources for it are not something most can afford. P.S also what mrcus said, if we trust the upstream build process, we may as well trust their binaries.
- Brian_K_White 3y agoThat was what the 1970 crack was about.