dart pub vendor

48 views
Skip to first unread message

Daniel Theophanes

unread,
Mar 11, 2022, 1:26:24 AMMar 11
to Dart Misc
I'm coming from Go, where I use "go mod vendor" to place all build dependencies into a project "vendor" folder. I then check-in this folder and ensure all changes to it are code reviewed. For multi-project setups, I can review code that goes into an alternate store that each client is configured to hit.

Is there an equivalent workflow possible in dart? Right now I'm struggling with finding a reasonable way to code review dependencies in dart.


Jonas Jensen

unread,
Mar 16, 2022, 6:33:53 AMMar 16
to Dart Misc, kard...@gmail.com
> Is there an equivalent workflow possible in dart?
As far as I'm aware there is no equivalent to vendoring as known from golang.

Hmm, I have actually been playing around with the idea...
My motivation was mainly the ability to workaround the single-package version limitation.

> Right now I'm struggling with finding a reasonable way to code review dependencies in dart.
I didn't know that vendoring was used for this purpose, but I guess it makes sense.

I think some organizations use custom package repositories:
Spoiler: there will also be a blog post on custom repositories later today.


Daniel Theophanes

unread,
Mar 16, 2022, 9:27:42 AMMar 16
to Jonas Jensen, Dart Misc
Thank you Mr. Jensen, I look forward to the blog post.

I will be writing a mobile accessible application in the next day or two, and I'm interested in using flutter for it, but it will have PHI in it and I refuse to use anything which the sources that build cannot be code reviewed in some type of review system.

In general, using a custom package repository doesn't sound promising given my timeline and investment in dart/flutter, but I look forward to the blog post.

Jonas Jensen

unread,
May 2, 2022, 12:19:05 PMMay 2
to Dart Misc, kard...@gmail.com, Dart Misc, Jonas Jensen
The ideas for how to vendor packages is something I'm playing with in a PR here:

Daniel Theophanes

unread,
May 2, 2022, 2:00:58 PMMay 2
to Dart Misc, jon...@google.com, Daniel Theophanes, Dart Misc
That certainly looks reasonable.

What we are doing right now, is using tool that re-writes .dart_tool/package_config.json rootUri path to a relative path under a repo controlled path. But this involves checking in that file and breaking some assumptions about pub.

-Daniel

Jonas Jensen

unread,
May 6, 2022, 5:01:03 AMMay 6
to Dart Misc, kard...@gmail.com, Jonas Jensen, Dart Misc
Please take a look at:
https://pub.dev/packages/vendor

And let me know how it works out :D

Reply all
Reply to author
Forward
0 new messages