pathetic piss kitten (@kitten)

pathetic piss kitten @kitten@elizabeth.cat

why just npm? we could say the same of pip, maven, crates.io, etc

pathetic piss kitten @kitten@elizabeth.cat

maven doesn't even have a lockfile, you could be deploying malware and not even have it in your development environment

Leah Neukirchen @leah@blahaj.social

@kitten Maven doesn't autoupdate tho?

pathetic piss kitten @kitten@elizabeth.cat

@leah but it doesn't need to to cause issues. without any hash check, you could be pulling different code every time

Leah Neukirchen @leah@blahaj.social

@kitten Yes, but at least maven central is immutable.

AliciaBytes @AliciaBytes@polycule.li

@kitten Then again how many people care about the lockfile in npm land? Too many people that don't know about npm ci and will happily think that the lockfile is doing things while npm install just updates over it...

pathetic piss kitten @kitten@elizabeth.cat

@AliciaBytes yes, that is also true. but I think the "infantilization" of software engineering is an additional separate issue. hot take but developers should be expected to know about that stuff

SillyDemon @SillyDemon@eepycats.place

@kitten i think it's good that there is tooling to make peoples life easier and this makes it easier to get into developing software.

The issue is in my experience that a lot of Software developers don't get out of the getting into software developing. Don't look further don't look at alternatives and risks.

Look at those software developers that just got into ai and just state ai as a solution without questioning well is that really a good idea to feed this data into this balckbox and should I really trust the response I got. Same issue just on steroids.

I wonder when people start to copy paste malware into their source code

@AliciaBytes

pathetic piss kitten @kitten@elizabeth.cat

@SillyDemon @AliciaBytes yes, that is true, that mindset is the root issue. even before AI, there was this "no code" trend which caused basically the same.

alien cactus (211695-343)

@echedellelr@masfloss.net

@kitten iirc you are supposed to lock in the pom file the specific versions and tag versioning differs a bit from other tools.

alien cactus (211695-343)

@echedellelr@masfloss.net

@kitten

maven.apache.org/pom.html#Dependency_Version_Requirement_Specification

maven.apache.org/pom.html#Version_Order_Specification

alien cactus (211695-343)

@echedellelr@masfloss.net

@kitten @leah if you build the artifact, you are supposed to have a local maven repository.

at least that is the concept of how is done.

yet i am unsure if the local maven cache counts as local repository and if building the artifacts there is supported.

pathetic piss kitten @kitten@elizabeth.cat

@echedellelr @leah yes, but the issue comes when your code leaves your local machine to be built and deployed elsewhere, usually through a CI pipeline that will just download the dependencies again from the origin without caring about your local repository

alien cactus (211695-343)

@echedellelr@masfloss.net

@kitten @leah maybe i don't see the whole view but if that CI machine is building the code, you trust that machine or you trust the original repository it downloads the sources from?

and if it is the first case in which you trust that CI, then that CI is responsible of having a maven repository for its own builds

or you are speaking about outsourcing your binary builds to another machine?

in such a case, why your local machine cares about that?

i am a bit confused about the reponsibility chain here

alien cactus (211695-343)

@echedellelr@masfloss.net

@kitten @leah

i somehow get that you want a machine to build things from another repository, so your local machine with its own development code executes the code built from that CI.

but at the same time you want to trust the original repository skipping the CI and ensuring the CI is not compromised.

pathetic piss kitten @kitten@elizabeth.cat

@echedellelr @leah no, I don't trust the original repository it downloads the sources from, that's why I want a way to automatically check that what I'm downloading hasn't changed since the last time I downloaded it

alien cactus (211695-343)

@echedellelr@masfloss.net

@kitten @leah oh, so you want checksum caching?

pathetic piss kitten @kitten@elizabeth.cat

@echedellelr @leah i wouldn't use the word "caching" but yes. the equivalent to package-lock.json in npm, go.sum in Golang, and so on

alien cactus (211695-343)

@echedellelr@masfloss.net

@kitten @leah maven.apache.org/guides/mini/guide-reproducible-builds.html

maven local cache counts as maven local repository and it saves the checksums btw.

also, you can verify your output with original things with that.

Xerz 💗 @xerz@fedi.xerz.one

@echedellelr @kitten @leah

Notice: starting with Maven 4.0.0-beta-5, Reproducible Builds mode will be active by default (see MNG-8258), without modifying project’s pom.xml. Setting a value in your pom.xml will only be useful if you want to override the inherited value.

oh, that’s actually kinda neatneat

alien cactus (211695-343)

@echedellelr@masfloss.net

@xerz @leah @kitten maven.apache.org/resolver/expected-checksums.html

also reading about this

Xerz 💗 @xerz@fedi.xerz.one

@echedellelr @leah @kitten I’ll say tho, Maven per se does not guarantee reproducibility because, unlike e.g. Nix or Yarn, it’s not recreating its environment from scratch, so users can do whatever they want and break reproducibility anyway

but it’s trying

alien cactus (211695-343)

@echedellelr@masfloss.net

@xerz @leah @kitten what they provide is project reproducibility, which is exactly what they speak about

and yes, verification will fail if something in your environment is off

Xerz 💗 @xerz@fedi.xerz.one

@echedellelr @leah @kitten

A build is reproducible if given the same source code, build environment and build instructions, any party can recreate bit-by-bit identical copies of all specified artifacts.

again, they’re only giving the tools so that they’re possible, but they’re not making it automatic or mandatory, despite the changes in Maven 4… so much better than nothing (it most definitely stops MitM attacks), but still gonna make people push for Docker anyway

alien cactus (211695-343)

@echedellelr@masfloss.net

@xerz @leah @kitten pushing for docker is up to the user problem

you are mixing system reproducibility with artifact reproducibility.

if your project needs a whole system to be changed, something is bad in your project and should be adressed

Leah Neukirchen @leah@blahaj.social

@kitten @echedellelr tada github.com/chains-project/maven-lockfile

pathetic piss kitten @kitten@elizabeth.cat

@leah @echedellelr yeah but that's cheating :blobcatgiggle: that's not part of maven

pathetic piss kitten @kitten@elizabeth.cat

@leah @echedellelr like, I might as well just start using Gradle, which does have that built-in

Xerz 💗 @xerz@fedi.xerz.one

@kitten @leah @echedellelr ….Gradle tho….

alien cactus (211695-343)

@echedellelr@masfloss.net

@kitten @leah is a maven plugin, as maven by definition is built to be extended.

so it can be considered part of maven if you see it in that way. however i need to check but i am nearly sure the issue is already addressed.

Fiona

🔜 Wiccon, eth0, 40c3 @Fiona@blahaj.zone

@kitten I mean: I do say that…

Dependencies should be managed via the system’s package manager such as pacman, not by programming language specific ones.