TL;DR Distributing Nim with a rich standard library or with a bundle of "core" 
libraries is important for many use cases.

In some organizations the same team writes software, selects 3rd party 
dependencies, builds, deploys and runs it. Despite the popularity of continuous 
deployment, the majority of software in the world is not written / packaged / 
build / maintained within the same organization.

1) Many software distributions need to provide one package for each library to 
allow for security updates, bugfixing, legal review, license compliance with a 
sustainable amount of effort. As such pulling sources from the Internet during 
a build is not possible.

2) Many large companies, including FAANGs, implement internal distribution 
system with similar requirements and tend to be very careful around legal 
review. NPM-style dependency sprawl makes the process very time consuming and 
difficult to justify for a language that is less popular than others.

3) Also, many companies buy or sell indemnification / assurance for risks of 
license violations. Often it provides a blanket approval for anything shipped 
in well-known Linux distributions but not for other sources.

When it comes to smaller organizations or individuals, having a 
battery-included Nim can help:

4) To allow colleagues, customers, security researchers unfamiliar with Nim 
make a simple code change and rebuild.

5) To ensure reproducible results in a scientific environment. E.g. researchers 
might want to run a data pipeline 5+ years after the code was published. This 
also applies to high-security environments.

6) To prove that a contract for custom software development was fullfilled: 
i.e. the software can be easily built and run on a given version of an OS at 
any time in the future.

7) keeping track of the whole lifecycle of 3rd parties libraries (e.g. 
compatibility with Nim versions, general quality, security issues) requires a 
long-term commitment. This can be acceptable for teams developing primarily in 
Nim but creates an entry barrier for others.

A lot of software runs for 5+ years after the last release and might need small 
fixes after the upstream development has stopped. (There are also extreme 
cases: the [CIP](https://www.cip-project.org/) project aims to ship a small 
Linux distribution and backport security fixes for 25 years to support critical 
infrastructure like power plants)

Personally, I like to know that if I build something against the compiler 
shipped in Debian I'll be able to easily backport a fix and rebuild it for 5+ 
years.

Reply via email to