-
Notifications
You must be signed in to change notification settings - Fork 350
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
check in the dart pub lockfile in tree #2157
Conversation
this package provides an executable, and as such should contain the lockfile
that goes against distro policies that are in place so we know what we're actually building and shipping to users. lockfiles include checksums of the dependencies used |
I don't think check this in is the right solution, as it adds more problem to development and testing. A better solution would be to add a
|
@selfisekai What's the specific goal of having a If this is still very important, I suppose there's no harm in uploading a lockfile along with the release, but I'm not sure it'll actually provide any material benefits beyond what you'd get by creating one yourself. |
reproducible builds (versions and checksums pinned, so builds are not changed by dependency's new release or a swap). from the most practical side tho, we have to rebuild packages regularly (e.g. with new dart release). a lockfile just limits the possibilities of other, possibly breaking changes
not separately maintaining a >600 lines file that has to be updated on version bumps |
To provide a bit more context. @selfisekai a maintainer of alpine-linux. They have they own packaging of dart-sdk and dart-sass that is different from https://github.com/dart-musl/dart and the linux-musl package we ship. This is https://github.com/dart-musl/dart:
This is dart-sdk from alpine-linux:
The main difference is that https://github.com/dart-musl/dart is optimized for compatibility and portability that all libraries except musl-libc are bundled. It is the same way like the official dart-sdk that all libraries except glibc are bundled. The dart-sdk shipped with alpine-linux is optimized for binary size, that it is dynamically linked with dependencies libraries. The dart-sass package that alpine-linux ships is also optimized for binary size, that the package is effectively only an aot-snapshot and a shell script. The dart-sass package from alpine-linux does not ship any dart runtime by itself, as the shell script just runs the dart runtime provided by the dart-sdk package. - Therefore if the dart-sdk package gets an update, the dart-sass package would need a rebuild, because aot-snapshot is sdk version dependent. - I think what @selfisekai is looking for is that each time dart-sass is rebuild for a new sdk version it would get the same dependency. |
@selfisekai Question for you is that, what's the issue with the approach that you already have https://git.alpinelinux.org/aports/tree/testing/dart-sass/lock.patch This should already give you “reproducible” builds. If your goal is to provide a build that is same as what we've released here in this repo, I have to remind you we don't rebuild dart-sass release when new dart-sdk is available, so even if you have |
Yeah, that's the thing—I don't think checking in |
it does not, it's just about the fact of maintaining it separately |
If this is just for convenience, I'd prefer to avoid checking in the lockfile. |
this package provides an executable, and as such should contain the lockfile