dart pub vendor

[Daniel Theophanes]

I'm coming from Go, where I use "go mod vendor" to place all build dependencies into a project "vendor" folder. I then check-in this folder and ensure all changes to it are code reviewed. For multi-project setups, I can review code that goes into an alternate store that each client is configured to hit.

Is there an equivalent workflow possible in dart? Right now I'm struggling with finding a reasonable way to code review dependencies in dart.

[Jonas Jensen]

> Is there an equivalent workflow possible in dart?

As far as I'm aware there is no equivalent to vendoring as known from golang.

Hmm, I have actually been playing around with the idea...

My motivation was mainly the ability to workaround the single-package version limitation.

> Right now I'm struggling with finding a reasonable way to code review dependencies in dart.

I didn't know that vendoring was used for this purpose, but I guess it makes sense.

I think some organizations use custom package repositories:

https://dart.dev/tools/pub/custom-package-repositories

Spoiler: there will also be a blog post on custom repositories later today.

[Daniel Theophanes]

Thank you Mr. Jensen, I look forward to the blog post.

I will be writing a mobile accessible application in the next day or two, and I'm interested in using flutter for it, but it will have PHI in it and I refuse to use anything which the sources that build cannot be code reviewed in some type of review system.

In general, using a custom package repository doesn't sound promising given my timeline and investment in dart/flutter, but I look forward to the blog post.

[Jonas Jensen]

The ideas for how to vendor packages is something I'm playing with in a PR here:

https://github.com/google/dart-neats/pull/173

Blog post on custom repositories went out here:
https://medium.com/dartlang/hosting-a-private-dart-package-repository-774c3c51dff9

[Daniel Theophanes]

That certainly looks reasonable.

What we are doing right now, is using tool that re-writes .dart_tool/package_config.json rootUri path to a relative path under a repo controlled path. But this involves checking in that file and breaking some assumptions about pub.

-Daniel

[Jonas Jensen]

Please take a look at:
https://pub.dev/packages/vendor

And let me know how it works out :D