[yread]

Nuget/.NET ecosystem just handles it so much better. Netvips assumes libvips is available and they provide packages for common platforms. No need to waste electricity rebuilding stuff, or install native build chains, build and test deps. Similar for Skia or Sqlite or whatever.

[jcupitt]

sharp does this too:

https://sharp.pixelplumbing.com/install/#prebuilt-binaries

it can sometimes need to compile the C++ shim that sits between node and libvips, but that's rare.

[tom1337]

but how can you verify that the prebuilt binaries aren’t compromised?

[voidUpdate]

Out of interest, do you verify that every single binary file on your machine isn't compromised? All the packages coming from your package manager?

[tom1337]

I absolutely don't. I even sometimes use "curl | bash" to install new things on my machine because most of the time it's easy and I tend to trust the authors.

My point was just that I don't think moving to pre-built binaries solves this issue.

[jcupitt]

sharp downloads over https and checks the sha256 (I think?) of the archive.