undefined | Better HN

0 pointsjackewiehose6y ago0 comments

If their build-system depends on external URLs they had that coming.

0 comments

2 comments · 1 top-level

djsumdog6y ago· 1 in thread

Umm ... requirements.txt and pypi? Sbt/Maven/Gradle and maven/ivy repos? package.json?

Unless you setup a local caching, non-deleting, JFrog artifactory for all your dependencies (only jar files are covered in the free version BTW, and there aren't any tools that handle all those repo types in the OSS world), you are going to depend on external URLs.

Locally caching dependencies is not trivial.

rkeene26y ago

This is why my build systems will only use release tarballs that can be cached. I built HashCache [0][1] to handle caching of these tarballs by their SHA-256, then the build system can fetch from there first to ensure a local mirror is available. My download process sometimes also caches into my home directory (into ~/.local/cache/by-hash/sha256/...) to avoid hitting the network at all if possible.

Also, some tools try to download things from the internet as part of the BUILD process. I also disable that using another tool [2].

Combined this really helps in being able to build my software when upstream goes away.

[0] http://hashcache.rkeene.org/ [1] https://chiselapp.com/user/rkeene/repository/hashcache/ [2] https://chiselapp.com/user/rkeene/repository/bash-drop-netwo...

j / k navigate · click thread line to collapse