Skip to content

Commit

Permalink
Merge pull request #222 from TheRakeshPurohit/patch-1
Browse files Browse the repository at this point in the history
fix types: 2024-09-03-the-fundamental-law-of-dependencies.dj
  • Loading branch information
matklad authored Sep 4, 2024
2 parents 9065534 + ff64122 commit 1e629af
Showing 1 changed file with 3 additions and 3 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -25,20 +25,20 @@ platform, because the Linux and the Windows versions of the compiler differ. Thi
your project should include one compiler's hash per platform, one hash is enough. Compiler
distribution should include a manifest -- a small text file which lists all platform and their
platform specific hashes. The single hash of _that_ file is what is to be included by downstream
consumers. To verify a specific binary, the consumer first downloads a manifest and checks that it
consumers. To verify a specific binary, the consumer first downloads a manifest, checks that it
has the correct hash, and then extracts the hash for the specific platform.

---

The law is an instrumental goal. By itself, hashes are not _that_ useful. But to get to the point
where you actually _know_ the hashes requires:

* Actually learning _what_ are you dependencies (this is _not_ trivial! If you have a single
* Actually learning _what_ are your dependencies (this is _not_ trivial! If you have a single
Makefile or an `.sh`, you most likely don't know the set of your dependencies).
* Coming up with some automated way to download those dependencies.
* Fixing dependencies's build process to become reproducible, so as to have a meaningful hash at
all.
* Learning to isolate dependencies per project, as hashed dependencies can't be installed into a
global shared namespace.

_These_ things are what actually makes developing software easier.
_These_ things are what actually make developing software easier.

0 comments on commit 1e629af

Please sign in to comment.