4 ms·
Some projects like to vendor their dependencies so they don’t have to rely on the supply chain staying up and can create hermetic builds. Of course this prevent
by vsgherzi 7mo ago
Some projects like to vendor their dependencies so they don’t have to rely on the supply chain staying up and can create hermetic builds. Of course this prevents you from getting security updates and bug fixes but that’s the trade off.
I know someone’s going to say “you can lock the dependencies ” but this does not make it for sure that you’ll get a 1 for 1 copy of the dependencies again. Some node modules npm I internally or do other build procedures
- deleted 7mo ago[deleted]
- TZubiri 7mo ago"I know someone’s going to say “you can lock the dependencies ” but this does not make it for sure that you’ll get a 1 for 1 copy" It doesn't. Node ecosystem keeps getting worse the closer you look at it. At that point I'd shove the npm tooling up my ass and make a zip and hash it, with some simple instructions to retrieve it. Under no circumstance would I upload code from a dependency into the repo. Much less the dependencies of the dependencies. Even if you are at the point where you are concerned about the vendor ceasing to exist and distribute the code, I would self host it and download it from my own url at build time. Uploading the code is such a last resort move. I don't think it's a trivial mistake, having a 50MB codebase and 500KLoc instead of 50Kb and 5Kloc, is a great way to force yourself and others to enter into 'make thing work' mode instead of 'understand thing' mode.
- MarsIronPI 7mo ago> At that point I'd shove the npm tooling up my ass and make a zip and hash it, with some simple instructions to retrieve it This is basically what Nixpkgs does. Every NPM package depends on its NPM dependencies zip, and the hash of the dependencies is stored with the package metadata. NPM is awful.