18
Who Should Pay For Source Code Availability? (kristoff.it)
submitted 3 months ago by to c/opensource@programming.dev
14 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 6 points 3 months ago* (7 children)

Based on the description from the article

Vendoring means taking it one step further: you commit all your dependencies’ source code into your own repo so the act of cloning the project gets you literally everything.

Forking is when you make a clone of a git repository, so you would check out a copy of the source code from your dependencies' repository, and then push them as their own repositories to Codeberg or wherever.

Vendoring is taking the result of your dependency installation, like your node_modules folder, and checking it in to your own repository. So, instead of 15 or whatever repositories with other folks' source code, you have just one repository with the built libraries checked in.

The benefit to forking is you can rebuild from source if you so choose, but the Vendoring means taking it one step further: you commit all your dependencies’ source code into your own repo so the act of cloning the project gets you literally everything. is it's a lot of repos to keep track of. The benefit to forking is you just reinstall the dependencies and check in the result, but the downside is your single repository is huge and takes forever to clone.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 7 child comments
    •
  • [–] 5 points 3 months ago (6 children)

    So .. using a dependency as a submodule?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 6 child comments
    •
  • [–] 1 point 3 months ago (5 children)

    You could do it as submodules, yeah, or using lfs, or also just check in the deps without their corresponding git history.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 4 points 3 months ago (4 children)

    This does appear to then break the chain of trust for the users of the project, since it then requires downstream to review even more code.

    For example, if you're an OSS user of three projects that each depend on library X, you now need to trust three copies of this library and make sure that they're the same as the original.

    This seems to be a solution that makes the problem bigger for everyone, not smaller.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 1 point 3 months ago* (3 children)

    I suppose? You’re either reviewing your dependencies or you’re not; I don’t think it matters much whether the unreviewed code comes in via a commit to your git repo or via a package manager. Once you’ve decided to either vendor or fork, that it matches your upstream becomes much less important — what matters is it works for your project. Either approach definitely comes with tradeoffs, that’s for sure; I only fork when I need to float a commit, and I prefer to maintain an artifactory if high availability is required.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 2 points 3 months ago (2 children)

    I meant the users of your project.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •