Re: Lua Ecosystem

["Pierre Chapuis" <catwell@...>]

> 2013/11/26 Sean Conner <sean@conman.org>:

> 1. Is there any moderation whatsoever, or can any idiot,
> con man or whoever upload something and suddenly
> it's got rock status?

Currently, no, there is moderation. Unlike most other
languages, to submit a rock, you notify a mailing list
and Hisham adds it to the repository.

> 2. Once I have uploaded a rock, is there any way that
> someone who is not me can upload something claiming
> to be a newer version of it?

No, see above.

> 3. Is there any mechanism in place where users can give
> just +1 and -1 feedback?

No. Well, +1 is basically what I am doing with
https://lua-toolbox.com/ :) And Hisham and me were
discussing feeding the results back into LuaRocks.

I don't really want -1, I think most people wouldn't use
it and it could result in pointless fights if used.

> 4. Would it be utterly and completely impractical to impose
> certain minimal standardizations, e.g.
>
> - require "module" always returns something callable
> - require "module" "_SIGNATURE" returns a unique
> string that is automatically allocated when that version
> of the rock is uploaded.

I don't think this is a good idea. Requiring require
to return *something* (usually a table), why not.

I think the signature thing would be better dealt with
in LuaRocks itself. You can atually require parts of
LuaRocks in your program if you want, I do it in
Lua Toolbox [1].

But modifying the module itself is not a great idea IMO.
A design principle of the recent versions of LuaRocks is
that you can use it just to install modules and have it
stay out of the way after that.

[1] https://github.com/catwell/lua-toolbox/blob/master/model.lua