couchdb-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Noah Slater <>
Subject Re: tracking upstream dependencies
Date Fri, 26 Nov 2010 20:44:15 GMT
The release artefact absolutely should not, ever, pull down files from the network. However,
I can see a way forward by having the bootstrap script manage the bundling of external dependancies.
The bootstrap script should only ever be run from a checkout of the code. Whatever it downloaded
and prepared would be included as part of the release artefact.

But assuming we got this working, we face the problem of not being able to apply our own patches.
Also, the software it downloads might have some bug in it that was introduced a week, day,
or hour before the release was made. How would we defend ourselves against this?

On 26 Nov 2010, at 20:38, Adam Kocoloski wrote:

> Hi all, there's a discussion in the 1.0.2 voting thread about better tracking of upstream
dependencies like mochiweb.  One point that keeps getting brought up is that build systems
should not need network access.  Is that a rule which applies to building from an SCM repo,
or only to builds of release artifacts?
> I think we might be able to make our lives easier if we only bundled upstream dependencies
at release generation time, and otherwise relied on the build system to retrieve them.  For
a concrete example, BigCouch recently switched to using rebar for dependency resolution. 
The main repo at only has the couch OTP application in
it, the other dependencies are pulled from forked git repositories containing CouchDB-specific
branches and tags such as
> If the no-network-access rule does apply to SCM builds, we might consider bundling full
git repos instead of doing the source code copy/paste dance.  At least this would allow a
clearer indication of where we stand w.r.t upstream.  Best,
> Adam

View raw message