@aeva @koronkebitch
Hi Aeva!
> its dependency tree is a pain to audit
Please, expand on this, do you mean the #Racket pkgs? or the dependencies that Racket needs to build core?
If its the 1st case I coulndt agree more. Racket's `raco pkg` is not fit for a secure supply chain. But it does not prevent users from downloading or vendoring pkg deps manually (or via automated script). Crystal (a very good language that unfortunatelly lacks LSP) does this with their shards tool - there is no centralized pkg server, You have to specify the upstream and version/tag for each of your deps. My major pain point with the Racket pkg server is that it does not save versions (as tagged by authors). This is semi-fixed by racksnaps.defn.io
In the 2nd case I disagree, Racket core deps are pretty minimal:
sqlite, libffi, ncurses, libjpeg-turbo, glib, fontconfig, cairo, pango.
Believe me, it is not common to see a language this minimal. Another thing: compiling those deps is a breeze. Let's take any Rust-based language such as Gleam (that is also a fantastic lang) - here you have to compile the Rust toolchain, LLVM, clang, and also the runtime which is Your pick of Erlang or NodeJS, that's at least 4h compared to maybe 1h tops for Racket.