2 ms·

I feel like leftpad has given package managers a very bad name. I understand the OP's hesitation, but it feels a little ridiculous to me. tokio is a work-steal

I feel like leftpad has given package managers a very bad name. I understand the OP's hesitation, but it feels a little ridiculous to me. tokio is a work-stealing, asynchronous runtime. This is a feature that would be an entire language. Does OP consider it reasonable to audit the entire Go language? or the V8 engine for Node? v8 is ~10x more lines than tokio. If Cloudflare uses Node, would you expect Cloudflare to audit v8 quarterly?

timewizard 1y ago
If two different dependencies use a different version of some other dependency between them does cargo still include both versions by default? This is something I've only ever seen cargo do.
- metaltyphoon 1y ago
  > If two different dependencies use a different version of some other dependency between them does cargo still include both versions by default? No, cargo will resolve using sem ver compatibility and pick the best version. Nuget, for C# does something very similar.
- rcxdude 1y ago
  It'll do that if there isn't a single version that meets both requirements. Which is a great thing, because most other languages will just fail the build in that case (well, there are still cases where it won't even work in rust, if types from those sub-dependencies are passed in between the two closer dependencies)
- pas 1y ago
  > This is something I've only ever seen cargo do. npm does this (which causes [caused?] the node_modules directory to have a megazillion of files usually, but sometimes "hoisting" common dependencies helps, and there's Yarn's PnP [which hooks into Node's require() and keeps packages as ZIPs], and pnpm uses symlinks/hardlinks)
conradludgate 1y ago
And for what it's worth, people do audit tokio. I have audited tokio. Many times in fact. Sure, not everyone will, but someone will :)
- j1elo 1y ago
  How does one approach doing so? Do you open the main.rs file (or whichever is the entry point) and start reading code and referenced functions on a breadth-first search (BFS) manner?

timewizard 1y ago

If two different dependencies use a different version of some other dependency between them does cargo still include both versions by default? This is something I've only ever seen cargo do.

metaltyphoon 1y ago
> If two different dependencies use a different version of some other dependency between them does cargo still include both versions by default? No, cargo will resolve using sem ver compatibility and pick the best version. Nuget, for C# does something very similar.
rcxdude 1y ago
It'll do that if there isn't a single version that meets both requirements. Which is a great thing, because most other languages will just fail the build in that case (well, there are still cases where it won't even work in rust, if types from those sub-dependencies are passed in between the two closer dependencies)
pas 1y ago
> This is something I've only ever seen cargo do. npm does this (which causes [caused?] the node_modules directory to have a megazillion of files usually, but sometimes "hoisting" common dependencies helps, and there's Yarn's PnP [which hooks into Node's require() and keeps packages as ZIPs], and pnpm uses symlinks/hardlinks)

conradludgate 1y ago

And for what it's worth, people do audit tokio. I have audited tokio. Many times in fact. Sure, not everyone will, but someone will :)

j1elo 1y ago
How does one approach doing so? Do you open the main.rs file (or whichever is the entry point) and start reading code and referenced functions on a breadth-first search (BFS) manner?