3 ms·
Guys say it with me: vendor your packages! VENDER YOUR PACKAGES!
by const_cast 1y ago
Guys say it with me: vendor your packages! VENDER YOUR PACKAGES!
- Ygg2 1y agoVendor or fork?
- jen20 1y agoCorporate needs you to find the difference between the two pictures. They’re the same picture.
- kpcyrd 1y agoHow about: commit your dependency lockfiles, make sure they use content-addressing cryptographic checksums like Cargo.lock does. This is also needed for both reproducible builds and SBOMs. If you commit the actual source code you're making things worse, because it makes coordinated source code review efforts a lot harder. Also patch management with actual vendored source code is terrible.
- xboxnolifes 1y agoAnd mirror your dependencies.