11 ms·

You're making your customer's life miserable by having dependencies. You're a library, your customer is using you to solve a specific problem. Write the code to

You're making your customer's life miserable by having dependencies. You're a library, your customer is using you to solve a specific problem. Write the code to solve that and be done with it. In the game development sphere, there's plenty of giant middleware packages for audio playback, physics engines, renderers, and other problems that are 1000x more complex and more useful than any given npm package, and yet I somehow don't have to "manage a dependency tree" and "resolve peer dependency conflicts" when using them.

adev_ 1y ago
> You're making your customer's life miserable by having dependencies. You're a library, your customer is using you to solve a specific problem. Write the code to solve that and be done with it. And you just don't know what you are talking about. If I am providing (lets say) a library that provides some high level features for a car ADAS system on top of a CAN network with a proprietary library as driver and interface. This is not up to me to fix or choose the library and the driver version that the customer will use. He will choose the certified version he will ship, he will test my software on it and integrate it. Vendoring dependency for anything which is not a final product (product as executable) is plain stupid. It is a guarantee of pain and ABI madness for anybody having to deal with the integration of your blob later on. If you want to vendor, do vendor, but stick to executables with well-defined IPC systems.
- alexvitkov 1y ago
  > If I am providing (lets say) a library that provides some high level features for a car ADAS system on top of a CAN network with a proprietary library as driver and interface. If you're writing an ADAS system, and you have a "dependency tree" that needs to be "resolved" by a package manager, you should be fired immediately. Any software that has lives riding on it, if it has dependencies, must be certified against a specific version of them, that should 100% of the time, without exceptions, must be vendored with the software. > It is a guarantee of pain and ABI madness for anybody having to deal with the integration of your blob later on. The exact opposite. Vendoring is the ONLY way to prevent the ABI madness of "v1.3.1 of libfoo exports libfoo_a but not libfoo_b, and v1.3.2 exports libfoo_b but not libfoo_c, and in 1.3.2 libfoo_b takes in a pointer to a struct that has a different layout." If you MUST have libfoo (which you don't), you link your version of libfoo into your blob and you never expose any libfoo symbols in your library's blob.
  - seba_dos1 1y ago
    You keep confirming that you don't know what you are talking about. The vendoring step happens at something like Yocto or equivalent and that's what ends up being certified, not random library repos.
    - adev_ 1y ago
      Yes exactly. And in addition: Yocto (or equivalent) will also be the one providing you the traceability required to guarantee that what you ship is currently what you certified and not some random garbage compiled in a laptop user directory.
      - BobbyTables2 1y ago
        Did Yocto ever clean up how they manage the sysroot? It used to have a really bad design flaw. Example: - building package X explicitly depends on A to be in the sysroot - building package Y explicitly depends on B in the sysroot, but implicitly will use A if present (thanks autoconf!) In such a situation, building X before Y will result in Y effectively using A&B — perhaps enabling unintended features. Building Y then X would produce a different Y. Coupled with the parallel build environment, it’s a recipe for highly non deterministic binaries — without even considering reproducibility.
        1718627440 1y ago
        > but implicitly will use A if present (thanks autoconf!) When you want reproducibility, you need to specify what you want, not let the computer guess. Why can't you use Y/configure --without-A ? In the extreme case you can also version config.status.
        BobbyTables2 1y ago
        One certainly can, but such is not default. Things using autotools evolved to be “manual user friendly” in the sense that application features are automatically enabled based on auto detected libraries. But for automated builds, all those smarts get in the way when the build environment is subject to variation. In theory, the Yocto recipe will fully specify the application configuration regardless of how the environment varies… Of course, in theory the most Byzantine build process will always function correctly too!
zahlman 1y ago
When you're a library, your customer is another developer. By vendoring needlessly, you potentially cause unavoidable bloat in someone else's product. If you interoperate with standard interfaces, your downstream should be able to choose what's on the other end of that interface.

adev_ 1y ago

> You're making your customer's life miserable by having dependencies. You're a library, your customer is using you to solve a specific problem. Write the code to solve that and be done with it. And you just don't know what you are talking about. If I am providing (lets say) a library that provides some high level features for a car ADAS system on top of a CAN network with a proprietary library as driver and interface. This is not up to me to fix or choose the library and the driver version that the customer will use. He will choose the certified version he will ship, he will test my software on it and integrate it. Vendoring dependency for anything which is not a final product (product as executable) is plain stupid. It is a guarantee of pain and ABI madness for anybody having to deal with the integration of your blob later on. If you want to vendor, do vendor, but stick to executables with well-defined IPC systems.

alexvitkov 1y ago
> If I am providing (lets say) a library that provides some high level features for a car ADAS system on top of a CAN network with a proprietary library as driver and interface. If you're writing an ADAS system, and you have a "dependency tree" that needs to be "resolved" by a package manager, you should be fired immediately. Any software that has lives riding on it, if it has dependencies, must be certified against a specific version of them, that should 100% of the time, without exceptions, must be vendored with the software. > It is a guarantee of pain and ABI madness for anybody having to deal with the integration of your blob later on. The exact opposite. Vendoring is the ONLY way to prevent the ABI madness of "v1.3.1 of libfoo exports libfoo_a but not libfoo_b, and v1.3.2 exports libfoo_b but not libfoo_c, and in 1.3.2 libfoo_b takes in a pointer to a struct that has a different layout." If you MUST have libfoo (which you don't), you link your version of libfoo into your blob and you never expose any libfoo symbols in your library's blob.
- seba_dos1 1y ago
  You keep confirming that you don't know what you are talking about. The vendoring step happens at something like Yocto or equivalent and that's what ends up being certified, not random library repos.
  - adev_ 1y ago
    Yes exactly. And in addition: Yocto (or equivalent) will also be the one providing you the traceability required to guarantee that what you ship is currently what you certified and not some random garbage compiled in a laptop user directory.
    - BobbyTables2 1y ago
      Did Yocto ever clean up how they manage the sysroot? It used to have a really bad design flaw. Example: - building package X explicitly depends on A to be in the sysroot - building package Y explicitly depends on B in the sysroot, but implicitly will use A if present (thanks autoconf!) In such a situation, building X before Y will result in Y effectively using A&B — perhaps enabling unintended features. Building Y then X would produce a different Y. Coupled with the parallel build environment, it’s a recipe for highly non deterministic binaries — without even considering reproducibility.
      - 1718627440 1y ago
        > but implicitly will use A if present (thanks autoconf!) When you want reproducibility, you need to specify what you want, not let the computer guess. Why can't you use Y/configure --without-A ? In the extreme case you can also version config.status.
        BobbyTables2 1y ago
        One certainly can, but such is not default. Things using autotools evolved to be “manual user friendly” in the sense that application features are automatically enabled based on auto detected libraries. But for automated builds, all those smarts get in the way when the build environment is subject to variation. In theory, the Yocto recipe will fully specify the application configuration regardless of how the environment varies… Of course, in theory the most Byzantine build process will always function correctly too!

zahlman 1y ago

When you're a library, your customer is another developer. By vendoring needlessly, you potentially cause unavoidable bloat in someone else's product. If you interoperate with standard interfaces, your downstream should be able to choose what's on the other end of that interface.