Use libraries over "system" commands

eayus / sirdi

Package manager for Idris

GNU General Public License v3.0

35 stars 11 forks source link

Use libraries over "system" commands #7

Open eayus opened 2 years ago

eayus commented 2 years ago

Currently a lot of our work is done using "system" commands. We should switch to libraries if they are available because:

It's faster, since the command line arguments do not need to be processed.
Easier to keep track of the "hidden" dependencies of sirdi.
It's more secure. On the command line, every argument is a string. This makes it much harder to prevent issues such as code injection.

The biggest offenders for this are probably git commands and idris2 --build ..., since there seems to be existing Idris2 libraries for both of these things.

eayus commented 2 years ago

So on further inspection, the Idris git library (https://github.com/bigs/idris2-libgit2) doesn't support everything we need. We need ls-remote equivalent behaviour (i.e., in libgit, https://github.com/libgit2/libgit2/blob/main/examples/ls-remote.c) so that we can get the latest commit hash of the repo.

I'm thinking that perhaps a more sensible solution is to just write a few C wrappers in this project for git stuff. We only really need clone and ls-remote at the moment.