Hacker News new | ask | show | jobs
by Ferret7446 16 days ago
Downloading a compiled module is a huge negative in the age of supply chain attacks; you're begging to get compromised.
1 comments

This is just optional.

I explained why it's not in the package in https://news.ycombinator.com/item?id=48881722

For all Emacs package updates, it's best of course to check the source what's changed and then you can compile yourself.

PS, I also think Emacs is one of the few ecosystems where people actually check what changed. It's not like npm where you have a million of deps unreviewed pulled in.

Personally I use borg and always at least quick check what changed, and most Emacs package managers have a similar feature.

Fwiw, in all my Ghostel updates recently, the Zig module failed to compile, with an error message from Zig about a line in the module source. I have a fairly up to date Zig installed via Homebrew.

I didn't have time to fix it so downloading the binary module has been the only option.

I had the same problem with vterm when I first tried it. The C module failed to compile, with a compiler error about a line in the source. As there was no downloadable binary module I fixed that one.

> I have a fairly up to date Zig installed via Homebrew.

This is likely the problem. Latest Zig is 0.16 and Ghostty (and therefor Ghostel) require exactly Zig 15.2.

I just updated our code to have a better error message and make it clear that the problem is the Zig version. See https://github.com/dakra/ghostel/pull/541

jFYI, Ghostty issue to support 0.16 is here: https://github.com/ghostty-org/ghostty/issues/12228

So for your homebrew zig you probably have to:

brew uninstall zig

brew install zig@0.15