DIP11: Automatic downloading of libraries

[Andrei Alexandrescu]

On 6/14/11 1:22 PM, Robert Clipsham wrote:
> On 14/06/2011 14:53, Andrei Alexandrescu wrote:
>> http://www.wikiservice.at/d/wiki.cgi?LanguageDevel/DIPs/DIP11
>>
>> Destroy.
>>
>>
>> Andrei
>
> This doesn't seem like the right solution to the problem - the correct
> solution, in my opinion, is to have a build tool/package manager handle
> this, not the compiler.
>
> Problems I see:
> * Remote server gets hacked, everyone using the library now
> executes malicious code

This liability is not different from a traditional setup.

> * Remote source changes how it is built, your code suddenly breaks and
> has to be updated, rather than being handled automatically

This is a deployment issue affecting this approach and any other relying 
on downloading stuff.

> * Adds a lot of unnecessary bloat and/or dependency on external modules
> + Want to compress source code? dmd now depends on decompression libs

Indeed, I think compression will indeed be commonly requested. The same 
has happened about Java - initially it relied on downloading .class 
files, but then jar files were soon to follow.

It's been a feature asked in this forum, independently of downloads. A 
poster implemented a complete rdmd-like program that deals with .zip files.

> + Want to use git? dmd now depends on git

Not if the server can serve files, or if you use a different tool.

> + Remote code uses new compression method that an older dmd doesn't
> support

If compression handling is needed, dmd can standardize on it just like 
jar files do.

> * Remote server is down - build takes forever while waiting

So does downloading or building with another tool.

> + Make dmd time out after a couple of seconds - build fails

So would build directed with any other tool.

> * Makes the assumption that the build machine is has internet
> connectivity, if it doesn't building suddenly gets a lot more
> complicated

Fair point.

> * Source code changes location, build breaks unless a redirect is
> possible - if it changes protocol it's useless

See my answer with a central repo.

My understanding is that you find automated download during the first 
build untenable, but manual download prior to the first build 
acceptable. I don't see such a large fracture between the two cases as 
you do.


Andrei