Dependency management

[d-e-s-o]

The topic has come up in the past, mostly here and here: whether to keep the current repository structure with vendored dependencies or not.

I think I've come to a point where I am ready to remove checked-in dependencies and move nitrocli/* into the repository's root. The main reasons for that: even with vendored dependencies cargo insists on an internet connection (or at least I never got that working to my satisfaction without) and dependency management is too cumbersome with the increasing number of dependencies we have.
As part of the removal, I'd also remove Cargo.lock from the repository and trust dependencies and their updates won't break the build (i.e., be semver compliant) and won't introduce malicious code.

Does anybody have concerns about such a move? @robinkrahl @jan23 @alex-nitrokey

Otherwise I'll probably go ahead and experiment with such a move on devel.

[jans23]

ok for me.

[robinkrahl]

I’m fine with the changes to the repository structure. But I’d rather keep Cargo.lock under version control: It’s the default for binaries and we should have a good reasons to choose a non-default setup. And while I trust our dependencies, mistakes are bound to happen. The Cargo.lock file allows us to easily go back to a working build. That makes debugging a lot easier.

[d-e-s-o]

Thanks for the feedback!

But I’d rather keep Cargo.lock under version control

Sounds good. I don't feel strongly either way and preserving Cargo.lock is surely the safer option.

[d-e-s-o]

I've updated devel accordingly.

[robinkrahl]

By the way, once this change is merged into master, links that point to the nitrocli folder (as recommended here) will no longer work. So we should try to find fix these links if possible. Here’s what I found using Google:

• https://support.nitrokey.com/t/is-there-a-nitrokey-cli/1624 (→ Szczepan)
• https://packages.gentoo.org/packages/app-crypt/nitrocli (→ Daniel)
• http://man7.org/linux/man-pages//man1/nitrocli.1.html (→ Daniel)

[d-e-s-o]

Good point. It makes sense to have a reminder, so let me actually reopen this issue until a new version is released.

[d-e-s-o]

nitrocli 0.3.2 is out with, with the vendored dependencies removed.

@szszszsz, would you mind updating the comment that Robin pointed out?

[szszszsz]

Sorry, I did not got notification from the comment's edit.
Done!

[d-e-s-o]

Thanks @szszszsz!

It will probably take more time until changes have trickled down to all the man pages, but it should happen eventually. Let me know if additional actions are required.

[d-e-s-o]

Hey @szszszsz , I noticed that there is another post references the old nitrocli URL: https://support.nitrokey.com/t/beginner-trying-to-use-nitrokey-storage-with-kodi-device/1822/2

Would you mind adjusting it as well?

Thanks!

[szszszsz]

Just fixed this one. There are more as far as I see - https://support.nitrokey.com/search?q=nitrocli. Will correct them too.

[d-e-s-o]

Awesome! Thanks for spotting and fixing those.