Structure of open source project's repository [closed]

Closed. This question is opinion-based. It is not currently accepting answers.

---

开发者_如何学JAVA

Want to improve this question? Update the question so it can be answered with facts and citations by editing this post.

Closed 3 years ago.

Improve this question

I'm in the beginning of starting a small open source project. When cloning the main repository one gets a complete build environment with all the libraries and all the tools needed to make an official installer file, with correct version numbers.

I like the fact that anyone who wants to contribute can clone the repository and get started with anything they want. But I'm thinking this makes it to easy for Evil People to create malicious installers and release into the wild.

How should it be structured? What do you recommend including in the repository, versus keeping on the build server only?

---

Leaving out your support libraries and build tools makes it a huge pain for:

• anybody who just wants to try out the software, perhaps on a platform for which you haven't provided an installer, or from a newer version that you've already released

• anybody who wants to contribute or hack on your project.

These are the people that you need to pull out all the stops to cater to in a project that won't have a marketing department pimping it out and won't have a full-time paid team developing new features and fixing bugs (aka, personal/open-source/hobby projects).

Nobody is going to play around with or hack on your project if its a huge pain in the ass to even get it to build, and they'll just move on to the next thing. Somebody who, for whatever reason, has an interest in spoofing your software with malicious intentions, is already going to be putting in much more effort than it would take to hunt down a few other packages to put an installer together, so you're deterring the wrong subset of users for no appreciable gain. (Consider it a form of security through obscurity. Which never works.)

Focus on making your repository accessible to users and other developers.

As an aside, people who are downloading and building software should be in the habit of checking the code anyways, or at the very least deciding whether or not they trust the distributor before installing and running stuff locally.

---

What you seem to be looking for is a directory layout. You tagged your question language-agnostic, but it does depend on the language(s)/framework/build tool you want to use. To give you some examples

• Standard directory layout if you build with maven
• For mixed languages
• django and ruby can create a default layout for you

It won't stop Evil People do evil things, but it will help your potential contributors.