The Fundamental Law Of Software Dependencies

The article states that canonical source code should include checksums for all dependencies. That includes the source tree itself, third-party libraries, transitive dependencies, and the compiler. It also says a compiler manifest can hold platform-specific hashes, with downstream consumers verifying the manifest hash and then the binary hash for their platform.

Reading notes

#

• The source tree itself should be hashed, which implies a content-addressed VCS such as git.
• Third-party libraries need a lockfile that covers the full dependency set and includes checksums.
• The lockfile is part of source code and is mixed into the VCS root hash.
• The compiler hash should be included in the lockfile, not just its version.
• Specifying both version and hash lets users trust the checksum instead of the distributor.
• Compiler distribution can use a manifest listing platform-specific hashes, with consumers verifying the manifest hash first.
• The law is an instrumental goal rather than an end in itself.
• Reaching known hashes requires identifying dependencies, automating downloads, making builds reproducible, and isolating dependencies per project.
• These are the changes the article says actually make software development easier.