3 ms·
> Wild West open-source repos There's a deeper issue though. I frequently have difficult getting things to build from source in a network isolated environment.
by fc417fc802 2y ago
> Wild West open-source repos
There's a deeper issue though. I frequently have difficult getting things to build from source in a network isolated environment. That's after I manually wrangle all the dependencies (and sub-deps, and sub-sub-deps, and ...).
Even worse is something like emscripten where you are fully expected to run `npm install`.
Any build process that depends on network access is fundamentally broken as far as I'm concerned.
- no_wizard 2y agoWhich is nearly all of them, except perhaps C/C++, that I can think of, in terms of languages broadly adopted You can cache and/or emulate the network to go offline but fundamentally a fresh build in most languages will want to hit a network at least by default
- robinsonb5 2y agoIn my world (VHDL/Verilog and some C/C++) there's a difference between the "fetch" and "build" steps. It's perfectly reasonable for the fetch step to require network access; the build step should not. The real problem is that some language ecosystems conflate those two steps.
- fc417fc802 2y agoI'm mostly on board with that dichotomy except that I think it's also important that all fetched artifacts either come from a VCS or are similarly cryptographically versioned and all historical versions made available in a reliable manner.
- robinsonb5 2y agoYes, absolutely - I can't disagree with that.
- fc417fc802 2y ago> at least by default Even in C/C++ after changing the relevant parameters to non-default values things often break. It seems those configurations often go untested. Google managed repos are a nice exception to this. Clearly documented commit hashes for all dependencies for a given release.