From 9637e2ac7f26464ce39a0e821e6829c2204a725b Mon Sep 17 00:00:00 2001 From: Meghan Denny Date: Tue, 23 Feb 2021 14:32:36 -0800 Subject: [PATCH] docs/principles- clarify why zig.mod is yaml instead of zig re: https://old.reddit.com/r/Zig/comments/lozuzy//go8xtet/ --- docs/principles.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/principles.md b/docs/principles.md index f8e4fe74ca00a24be500e717b6c62aa24cb8ab54..36a39a7796c9ef3079d25d08631e87f2a3912b91 100644 --- a/docs/principles.md +++ b/docs/principles.md @@ -2,7 +2,7 @@ Zigmod is a prototype package manager for Zig. An official one will eventually be made so I wanted to add this page to the docs to go over some of the guiding principles used in this project. Some are general good practice for app development but there will be added context in how they apply to making a package manager. ### 1. Be declarative -`zig.mod` is a static Yaml file that does not contain any Zig code. This was intentional to not allow packages to run arbitrary code on the developer's machine. A maintainer's computer is an arguably much more high risk attack surface so the trust of code should be kept to a minimum. Given that the environment may contain API/ssh/etc keys that provide access to things far wider than just the user's computer. +`zig.mod` is a static Yaml file that does not contain any Zig code. Placing packages' definition in its own file (say as opposed to in `build.zig`) was an intentional decision from the start to not allow packages to run arbitrary code on the developer's machine. A maintainer's computer is an arguably much more high risk attack surface so the trust of code should be kept to a minimum. Given that the environment may contain API/ssh/etc keys that provide access to things far wider than just the user's computer. ### 2. Be Immutable/Avoid the network as much as possible The network is slow and unreliable. So we should cache only what we need and avoid fetching unchanged data. This is achieved from a user's perspective by using versions on your dependencies that dont change. For example tags or commits when using git, or specifying a hash when using http. -- 2.54.0