News for hackers. Stuff that matters.

A comment on Evaluating Bazel for building Firefox. Parent comment

Re:Evaluating Bazel for building Firefox by chii on Tuesday October 29, 2019 @07:20AM (#21385871)
if the version shipped in bazel isn't right for you, then you're stuck with either having to customize it, or wait for it to update.
[ Parent | on HN ]
Re:Evaluating Bazel for building Firefox by danpalmer on Tuesday October 29, 2019 @08:00AM (#21386134)
But it doesn't have to be right for you, it only has to be right for Bazel. You wouldn't use it for anything else except Bazel, so is it a problem if it's out of date or lacking features? I think that's only a problem for the Bazel developers.
[ Parent | on HN ]
Re:Evaluating Bazel for building Firefox by btilly on Tuesday October 29, 2019 @04:40PM (#21391737)
It is a problem if it has a security hole. Or if you have reason not to trust the Bazel developers. (Or trust people who might have illegitimate access to said developers' machines - for example the NSA.)

See https://www.archive.ece.cmu.edu/~ganger/712.fall02/papers/p7... for the canonical paper on why it can be important to be able to recreate your build chain from scratch in a verified way.

[ Parent | on HN ]