4 ms·

Lockfiles are essential for somewhat reproducible builds. If a transient dependency (not directly referenced) updates, this might introduce different behavior

by andix 1y ago

Lockfiles are essential for somewhat reproducible builds. If a transient dependency (not directly referenced) updates, this might introduce different behavior. if you test a piece of software and fix some bugs, the next build shouldn't contain completely different versions of dependencies. This might introduce new bugs.

tonsky 1y ago
> Lockfiles are essential for somewhat reproducible builds. No they are not. Fully reproducible builds have existed without lockfiles for decades
- its-summertime 1y ago
  of distros, they usually refer to an upstream by hash https://src.fedoraproject.org/rpms/conky/blob/rawhide/f/sources https://src.fedoraproject.org/rpms/conky/blob/rawhide/f/sour... also of flathub https://github.com/flathub/com.belmoussaoui.ashpd.demo/blob/bf73e97322c7130a023b1d81fe5b8d766bffe492/com.belmoussaoui.ashpd.demo.json#L62 https://github.com/flathub/com.belmoussaoui.ashpd.demo/blob/... "they are not lockfiles!" is a debatable separate topic, but for a wider disconnected ecosystem of sources, you can't really rely on versions being useful for reproducibility
  - andix 1y ago
    > they usually refer to an upstream by hash exactly the same thing as a lockfile
- andix 1y ago
  Sure, without package managers. It's also not about fully reproducible builds, it's about a tradeoff to get modern package manger (npm, cargo, ...) experience and also somewhat reproducible builds.
  - chriswarbo 1y ago
    > modern package manger (npm, cargo, ...) experience Lol, the word "modern" has truly lost all meaning. Your list of "modern package managers" seems to coincide with a list of legacy tooling I wrote four years ago! https://news.ycombinator.com/item?id=29459209 https://news.ycombinator.com/item?id=29459209
- pluto_modadic 1y ago
  ...source? show me one "decades old build" of a major project that isn't based on 1) git hashes 2) fixed semver URLs or 3) exact semver in general.
jedberg 1y ago
The entire article is about why this isn't the case.
- andix 1y ago
  It suggests a way more ridiculous fix. As mentioned by other comments in detail (security patches for transient dependencies, multiple references to the same transient dependency).
  - yawaramin 1y ago
    The article and various comments in this same thread have explained why these are not real issues because the resolution process picks the version 'closest to root'.

by andix 1y ago

tonsky 1y ago

> Lockfiles are essential for somewhat reproducible builds. No they are not. Fully reproducible builds have existed without lockfiles for decades

its-summertime 1y ago
of distros, they usually refer to an upstream by hash https://src.fedoraproject.org/rpms/conky/blob/rawhide/f/sources https://src.fedoraproject.org/rpms/conky/blob/rawhide/f/sour... also of flathub https://github.com/flathub/com.belmoussaoui.ashpd.demo/blob/bf73e97322c7130a023b1d81fe5b8d766bffe492/com.belmoussaoui.ashpd.demo.json#L62 https://github.com/flathub/com.belmoussaoui.ashpd.demo/blob/... "they are not lockfiles!" is a debatable separate topic, but for a wider disconnected ecosystem of sources, you can't really rely on versions being useful for reproducibility
- andix 1y ago
  > they usually refer to an upstream by hash exactly the same thing as a lockfile
andix 1y ago
Sure, without package managers. It's also not about fully reproducible builds, it's about a tradeoff to get modern package manger (npm, cargo, ...) experience and also somewhat reproducible builds.
- chriswarbo 1y ago
  > modern package manger (npm, cargo, ...) experience Lol, the word "modern" has truly lost all meaning. Your list of "modern package managers" seems to coincide with a list of legacy tooling I wrote four years ago! https://news.ycombinator.com/item?id=29459209 https://news.ycombinator.com/item?id=29459209
pluto_modadic 1y ago
...source? show me one "decades old build" of a major project that isn't based on 1) git hashes 2) fixed semver URLs or 3) exact semver in general.

jedberg 1y ago

The entire article is about why this isn't the case.

andix 1y ago
It suggests a way more ridiculous fix. As mentioned by other comments in detail (security patches for transient dependencies, multiple references to the same transient dependency).
- yawaramin 1y ago
  The article and various comments in this same thread have explained why these are not real issues because the resolution process picks the version 'closest to root'.