Second+ Order BOM

[elharo]

Machine consumable file (likely Maven pom.xml) listing:

The complete dependency list of the libraries in #17 along with their required versions.

Test to verify this.

[patflynn]

I'm not convinced we need this. Second+ order deps should only be specified to resolve conflicts between our 1st order deps. Conceivably we could just include them with our 1st order deps? Or only include the conflict resolution dep statements in this second+ order artifact.

…

On Fri, Jul 13, 2018 at 3:17 PM Elliotte Rusty Harold < ***@***.***> wrote: Machine consumable file (likely Maven pom.xml) listing: The complete dependency list of the libraries in #17 <#17> along with their required versions. — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#18>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AHf5Hep5hzBvAqpiRQOJtbd6jGs8vxNhks5uGPIvgaJpZM4VPYpN> .

[cpovirk]

I think we were hoping to keep them separate for now mainly to avoid having the make that kind of decision :) For example, if someone advocates for a user-facing BOM that includes the 0th- and 1st-order deps but not the 2nd-order, then we want to be able to distinguish them. I don't think we intend to recommend use of this initial 2nd-order BOM to anyone (even ourselves) until we make these further decisions.

[patflynn]

Makes sense. So how about just the conflict resolution deps in this BOM?

…

On Fri, Jul 13, 2018 at 3:46 PM Chris Povirk ***@***.***> wrote: I think we were hoping to keep them separate for now mainly to avoid having the make that kind of decision :) For example, if someone advocates for a user-facing BOM that includes the 0th- and 1st-order deps but not the 2nd-order, then we want to be able to distinguish them. I don't think we intend to recommend use of this initial 2nd-order BOM to anyone (even ourselves) until we make these further decisions. — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#18 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AHf5HRge9IjZhQTPemyx97XEEsTjWV-Kks5uGPj7gaJpZM4VPYpN> .

[cpovirk]

Sounds reasonable to me, and possibly easier for Elliotte, to boot?

[elharo]

It's probably easier to simply list them all, than to list them all and then figure out which ones show up more than once. Furthermore a consumer of this file--i.e. an end user developer--is likely to want to know all of these since they may duplicate some of them in their own dependencies, even if we don't.

…

On Fri, Jul 13, 2018 at 4:12 PM, Chris Povirk ***@***.***> wrote: Sounds reasonable to me, and possibly easier for Elliotte, to boot? — You are receiving this because you were assigned. Reply to this email directly, view it on GitHub <#18 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AA9X6I-tmylqMrXLeA54X-uXKesq8sveks5uGP8kgaJpZM4VPYpN> .

-- Elliotte Rusty Harold elharo@macfaq.com

[elharo]

obsolete