Hacker News Reader

Vendoring prebuilt deps (jar/so/dll files) is the Right Thing. Anything else creates an extra point of failure that could prevent you from going to prod or reproducing an old build. Some take this seriously enough to vendor the exact toolchain as well.

View on HN

I meant vendoring the source code of dependencies when I wrote the parent comment, but it appears you feel strongly about going one step further? Vendoring arch-specific binaries? What is the benefit of doing that, in your opinion?

I just don't want to be in the business of maintaining our copy of someone else's toolchain and constantly rebuilding code that my team never edits. For non-java I could be talked into in-tree headers and moving native libs to a private deb/rpm repo.

Reply on news.ycombinator.com