[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: What to do when DD considers policy to be optional? [kubernetes]

 ❦ 24 mars 2020 03:11 +00, Paul Wise:

>> Specifically, as README.Debian states, the vendor/ subdirectory of the
>> source package contains more than two hundred Go libraries.
> There are a *lot* of embedded code/data copies in Debian already.
> While it would be nice to remove them, sometimes it isn't possible.
> Often the copies are forked, or upstream refuses to remove them,
> sometimes even though they forgot why they were added in the first
> place. In addition the developer culture in various communities
> encourages embedded copies. I think the best action we can do is send
> patches to upstream projects to switch from vendoring to using the
> native dependency system of the package manager for the related
> language community. ISTR reading that Go has one of those now.

Kubernetes is already using Go modules. They happen to have decided to
keep shipping a `vendor/` directory but this is not uncommon. It is
often considered as a protection against disappearing modules. So, there
is nothing to be done upstream. And BTW, there are currently 616
dependencies, pinned to a specific version.
Don't just echo the code with comments - make every comment count.
            - The Elements of Programming Style (Kernighan & Plauger)

Attachment: signature.asc
Description: PGP signature

Reply to: