2 ms·
> have all done a great job building amazing tooling to download and verify resources from the network against a lockfile This is a bad assumption
by fire_lake 2y ago
> have all done a great job building amazing tooling to download and verify resources from the network against a lockfile
This is a bad assumption
- IshKebab 2y agoWhy? Are you referring to the fact that it's opt-in; you have to use `cargo build --locked` or `npm ci`?
- bavarianbob 2y agoI interpreted the parent to mean that it might not be fair to assume existing package managers have done a _great_ job at downloading and verifying, especially verifying, resources from the network. There are businesses that exist attempting to solve this problem like socket.io. Safely installing the correct dependencies for a project is still not a guarantee from any of the major package managers.
- YuukiRey 2y agoIf the underlying package eco system is a mess then it’ll also be a mess in Nix. To this day Nix doesn’t really have a good answer to Python or JavaScript packaging. If the underlying package manager is good (Rust, Go) then there’s just no need to reinvent the wheel.