Thanks for the answer!
As I understand it, for each dependency the content of the tuple is
- :hex | :git ?
When it is hex, it uses the following hex endpoint?
|/tarballs/PACKAGE-VERSION.tar|
the last part of that tuple, is it the sha256 or some kind of validation
check?
If there are more formal specifications, I would be interested in having
a look.
Thoma depierre, that was indeed you who suggested the idea, thank you!
On 2021/04/22 1:23, Austin Ziegler wrote:
The mix.lock file can be interpreted as an exs file that produces a
map with tuples in the values. There have been migrations in the tuple
contents before, but it’s fairly stable and includes transitive
dependency information.
As I understand it, there have been developments recently that would
allow you to run your own Hex server in a mirror-caching mode, which
should assist with the deduplicated global store limiting network
access.
-a
On Wed, Apr 21, 2021 at 3:48 AM Megzari Raphael
<[email protected]> wrote:
The larger question I want to ask is
What is the way to get dependency information from outside elixir.
Use case
for build tools wanting to limit network access and encourage reproducibiliy.
For example if there was a way to find out what the dependencies are and how to
fetch them, this job could be done outside of mix. A tool with a global store
could keep deduplicated version of the dependencies and only fetched the ones
that changed. Mix does that already of course, but it's based on an using it's
own way to store dependencies.
Current barriers.
The mix.lock file format is undocumented and subject to change at any time.
Smaller question: are there plans regarding the format? Changes? How stable is
the current format?
Potential solution
Would an api from the cli make sense?
Something like mix deps.list outputting some json format maybe?
(note this idea is not mine and i'm not sure the person having it wants to be
cited)
--
You received this message because you are subscribed to the Google Groups
"elixir-lang-core" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/elixir-lang-core/a70d41f4-db7c-4958-829b-2d0810266e72n%40googlegroups.com.
--
You received this message because you are subscribed to the Google Groups
"elixir-lang-core" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/elixir-lang-core/9f43ea2a-24a1-86af-e5a8-9e05b9940200%40gmail.com.
