search

mario-eth / soldeer

Solidity Package Manager written in rust
MIT License
175 stars 18 forks source link

Better crawler to update `all_dependencies.toml` #2

Open mario-eth opened 1 year ago

mario-eth commented 1 year ago

We need a better way to update the all_dependencies.toml which contains the dependencies that the soldeer is calling to download the sources.

mario-eth commented 1 year ago

Problem Versioning for Solidity contracts is primarily managed by GitHub and npm. Some projects utilize the proper versioning and release features of GitHub before publishing to npm. However, not all projects adhere to this method.

1st Solution Develop a crawler that employs npm to retrieve versioning details and then uploads this information to this repository as a zip file, accompanied by a checksum. This checksum will serve those who wish to verify that the zip contains the genuine files and has not been tampered with. While this approach offers greater flexibility, it also raises trust concerns. Users would need to place significant trust in the repository for accurate versioning, which might also impose additional overhead on them.

2nd Solution Restrict the projects supported by Soldeer to only those that adhere to the proper versioning/release methodology. This would consequently reduce the number of projects that can be supported.