search

MetaMask / metamask-module-template

A simple template repository for starting new modules in the latest MetaMask fashion.
25 stars 23 forks source link

Add Lava-Moat #15

Closed danfinlay closed 3 years ago

danfinlay commented 3 years ago

How cool would it be if every MetaMask module shipped with its dependencies pre-confined by default via lava moat?

Problem currently this template repo uses rollup as its build system, but Lava Moat only has plugins for browserify and webpack. This means we either need to switch this project to one of those (like this PR that converts it to webpack), or add a lava-moat plugin for rollup.

one guide on creating a rollup plugin

Gudahtt commented 3 years ago

I don't think LavaMoat confinement makes sense for libraries, which is primarily what this template repo is for. It makes sense for the build system, but the library itself should get confined as part of the application build process.

The library can't ultimately be responsible for confining and auditing dependencies because the library doesn't choose which versions to use. The application does.

danfinlay commented 3 years ago

Yeah, that's the same sentiment Aaron had. More discussion in our lavamoat channel. Closing this series of issues & PRs.