dependencies - Vendoring a native tool while retaining maximum portability -
the twelve-factor app manifesto says web applications "... have clean contract underlying operating system, offering maximum portability between execution environments" [emphasis added me]
but it says:
twelve-factor apps not rely on implicit existence of system tools. examples include shelling out
imagemagickorcurl. while these tools may exist on many or systems, there no guarantee exist on systems app may run in future, or whether version found on future system compatible app. if app needs shell out system tool, tool should vendored app.
and have earlier defined "vendored app" as:
scoped directory containing app (known “vendoring” or “bundling”).
how should done, when (on linux @ least) native 64-bit executables not run in 32-bit environments, example - let alone on other operating systems? or there better way of handling portability issue?
in opinion, it shouldn't done @ all. because:
- if native executables dynamically linked, there chance fail run merely on future os releases, let alone future or past processor architectures.
- as far understand it, not possible future-proof native executable statically-linking it. can still have issues. solaris doesn't support static linking of system libraries!
- library dependencies not kind of dependencies native tools can have. there can other issues well.
- old
imagemagicks - orcurls - may have security bugs allow application compromised. (this bit of contentious point - validity depends on trust more watch / apply security updates - people maintain , upgrade servers, or developers? of course might same people - now. working assumption here servers have updates applied eventually, in turn protect app security holes in system executables have been fixed in updates.)
my view: if dependency management system of choice point-blank cannot handle native executables, stick note in readme , done it. if don't have readme, create one. , (for in-house web apps) add native tools need standard server image or script use when setting server, , make sure keep additional note of why there.
Comments
Post a Comment