Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

The Coursier Metals Requirement #5

Open
davesmith00000 opened this issue May 10, 2024 · 2 comments
Open

The Coursier Metals Requirement #5

davesmith00000 opened this issue May 10, 2024 · 2 comments

Comments

@davesmith00000
Copy link

Hi,

If possible, I'd like to understand the requirement to install Metals via Coursier.

I managed to get Zed working with Scala briefly and thought the Metals integration was great! It didn't last long though.

Using Coursier is awkward for me because I tend to use Nix for a lot of tooling set up, and it seems the two don't work well together.

I don't want to get into the details of my exact set up (work machine), I'm just wondering if Coursier does something special that we could replicate via other installation methods? Or if the extension could be made more generally compatible?

Thanks!

@SlowBrainDude

This comment was marked as off-topic.

@tgodzik
Copy link
Contributor

tgodzik commented Jul 12, 2024

@davesmith00000 totally missed you message. You should be able to set COURSIER_CACHE per workspace to point to the local workspace (though it will duplicate a lot of jars for a lot of projects) but this would be more in line with how Nix works.

@SlowBrainDude I would try and refrain a bit with the comments, there is plenty of reason why things are working as they are currently and no need to criticise other people's work in this manner.

Building everything from sources and having fully reproducible builds can easily turn into nightmare for people and is not feasible on all possible configurations. Each approach has its issues, though there is no actual security issue here. Jar are not really binaries that can be run on their own, you still need to do that via java. The biggest issue is that caches could break or users might not be fully aware where their artifacts are. Source dependencies would not solve any security problems if users choose to run something themselves.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants