Don't just vendor - rebuild the ecosystem and persuade the vendor to work on software management ...

Posted Jan 28, 2025 13:35 UTC (Tue) by ms (subscriber, #41272)
In reply to: Don't just vendor - rebuild the ecosystem and persuade the vendor to work on software management ... by pizza
Parent article: Vendoring Go packages by default in Fedora

> Every layer in the stack wants "LTS" for everything but _their_ stuff. Because _nobody_ likes stuff changing out from underneath them. Oh, and doesn't want to pay anything for it of course. (see the histrionics over CentOS)

I completely agree with this. It's no doubt not perfect, but I do suspect "minimal version selection" (https://go.dev/ref/mod#minimal-version-selection) is better behaved in this regard. I'd love to see some statistics (assuming they could be gathered) as to the level of churn caused by the different version selection algorithms.

Don't just vendor - rebuild the ecosystem and persuade the vendor to work on software management ...

Posted Jan 30, 2025 14:08 UTC (Thu) by taladar (subscriber, #68407) [Link] (1 responses)

Isn't that just the same nonsense you find on dotnet where it selects the version with the fewest security fixes and the maximum number of known bugs?

The golang people are smart folks

Posted Feb 2, 2025 11:09 UTC (Sun) by CChittleborough (subscriber, #60775) [Link]

No, Go's Minimal Version Selection feature is quite advanced, and was built to answer real problems found by large projects.