Dependencies

2025-03-20

---

I use Yggdrasil on my personal devices. Yggdrasil is primarily an experiment in efficient decentralized routing, but its software implementation--an IPv6 tunnel on Linux and Windows and a VPN on Android--allow me to build a private local network over the Internet. I can connect to any of my devices from anywhere and transfer data between them easily.

Compiling Yggdrasil on Linux is straightforward in terms of commands. One simply installs Go, downloads the source code, and runs the build script. But during the build process, Yggdrasil pulls down several dozen dependencies from both Go modules and GitHub directly. The actual code that comprises Yggdrasil's source is far from sufficient to get Yggdrasil installed and running on one's computer.

I understand that complex, powerful tools like Yggdrasil have many more moving parts than can be maintained in one code repository. Internet technology is always evolving, and it takes a phenomenal amount of effort to develop it all. But relying on external sources to provide dependencies creates a single point of failure: network connectivity. I can't install Yggdrasil in an offline environment, even if all the core build requirements are otherwise met.

It might seem like Yggdrasil is a bad example of this, because Yggdrasil itself is a networking tool. But Yggdrasil is itself a software router, capable of routing over other protocols than TCP/IP. It can build networks that look like IPv6 to computers but are completely disconnected from the global Internet infrastructure. In such scenarios, how would I compile Yggdrasil? I'd have to build it on a machine that can access Yggdrasil's dependencies, then move the binaries over.

NNCP provides a good contrast to Yggdrasil's approach. NNCP also has dependencies in external repositories, but it gets around the issue by providing release tarballs with a snapshot of all the required dependencies. One can clone NNCP's source repo, and if one wanted to compile NNCP from that clone, one would have to download all the resources NNCP needs. But if all one wants to do is compile NNCP, a release tarball suffices. I've used them to build NNCP on completely offline systems many times.

Having external dependencies is not a bad thing in itself. But I think more programs should provide release mechanisms that contain snapshots of their dependencies. We won't be able to break our machines' addictions to the Internet otherwise.

---

[Last updated: 2025-03-20]