Re: Guix & IPFS

[Pjotr Prins <pjotr.public12@thebird.nl>]

On Mon, Oct 15, 2018 at 01:40:45PM +0200, Pierre Neidhardt wrote:
> > I'm not much into go, but it seems, that most of the times it is safe
> > to use another version of dependencies.
> 
> This is unrelated to Go: it's safe as long as there is no API breakage.  My
> understanding of the IPFS project is that they don't want to make that kind of
> assumptions.

The real issue is that we can not assume APIs are safe. It is actually a
wider problem. Every dependency is a new dimension and any combination
thereof may or may not work as expected. Things break. This is why
running tests is so important. If tests pass you can make an
assumption that at least the tested stuff works.

To be best theoretical approach is to use the exact same version
developers are using. But that is not even realistic because
dependencies themselves may be developed on different versions ;).
I.e., these are different teams of developers.

We can just hope the combination of dependencies we have works. This
is why distributions like Debian have such a long testing cycle. They
want to test the combinations of dependencies through and through.
Users of unstable and testing are the actual testers.  Stable API's?
Hmmm. Some are better than others.

For deployment, to fixate dependencies, guix channels offer a great
solution. GUIX_PACKAGE_PATH with a fixated guix tree also works. Guix
as a rolling distribution generally works, but we are using untested
combinations of software. And once in a while you hit a problem. 

The GO people have their own solution for fixating dependencies to
avoid this problem. I don't think it is a bad one, only problem it is
that they created their own ecosystem.

Pj.