48
Paco - The tiny package manager
(store.godotengine.org)
Paco is a free tiny package manager that provides a safer way to manage dependencies by downloading and installing packages from a trusted and predefined array rather than shipping addons and / or binaries directly with the project.
It's pretty much like Python, Go, or Ruby, where project dependencies can be installed from a list of packages and versions.
We’d love to get any feedback on this and know what you'd like to see improved
Thanks! 👋
You just pointed behaviors that never happened, like OP never said it does not matter. I can understand why that might be annoying so I wouldn't call that neutral and well-meant feedback compared to your previous replies.
In my second reply I pointed out why even the asset store is not a source you can blindly trust. In my third reply I meant to point out that deflecting with the project being free software is largely irrelevant, not to mention that OP asked for feedback. The "doesn't matter" part was pulled out of thin air, I'll admit, but it was based on the dismissive reply to pikl ("It’s free software mate lol").
We all agree on this, the engine does exactly this, do no click the "asset store" tab tho. Never download anything from it, could be insecure. You see what I mean?
OP accepted all relevant feedback from what I can read in this thread. What pikl wrote never happened, so same story to me.
There are still a few things missing from the project, but it does not look like a big deal, and I'd really like to see it finished.
The point is not that pulling any project from the asset store is insecure. It is for any code you download onto your computer that can execute arbitrary code. (In fact, yeah, the asset store itself could be dangerous, as it encourages people to download a package without first being able to inspect it. Again, I personally prefer pulling from a repo, which I can check out beforehand.)
The point is that a bad actor might be able to put themselves between your repository and the exact package version you're attempting to download, and give you something you did not expect. The checksum helps ensure that what you're getting was not tampered with, whether it by a man-in-the-middle, a hacker of the asset store, a hacker of the asset owner's account, or a malicious asset owner.
OP accepted the feedback, but they appeared to be.. let's say "more emotional" than others in this thread.
But hey, I appreciate you looking out for OP. They don't deserve to be piled on. I'm just trying to explain why I said what I said.
Everyone agree on this too and OP clearly mentionned checksums after you suggested a check and that's what should be implemented so that looks pretty fine too me. I like good endings :)