Hi Exegol team
Quick policy question: what’s Exegol’s preferred approach for installing/packaging tools?
Right now it feels a bit random/contributor-dependent, and I’m wondering if we should align on a default rule.
Option: A Prefer official releases (tags/packages)
Pros
- Typically more stable / fewer bugs
- Usually “lighter” artifacts than building from source -> better for users overall
- Often faster for end-users (even if build time is the main tradeoff on our side)
Cons
- Releases can be slow or infrequent (extreme example: BloodHound-Legacy has frequent commits but last GitHub release May 2023)
Option B: Track main/master (or latest commit)
Pros
- Immediate fixes/features, no need to wait for a release
- Can help contribute upstream by catching breakages early
Cons
- Higher risk of bugs/regressions
- Can break Exegol builds (we’ve seen this in older PRs), making the tool unusable for everyone
Questions
Do you have a preferred default (A vs B)?
Longer-term idea: consider pinning a specific commit SHA per tool (even when not sourcing from git), then upgrading tools individually via small, automated PRs. Each PR would bump one tool to a newer commit/version, run the build + basic smoke tests, and if it breaks, it’s easy to revert/pin back; similar to Dependabot’s workflow.
If you could automate this, it would be really cool: you keep Exegol stable and reproducible while still getting "daily updates" in a controlled, CI-validated way.
Hi Exegol team
Quick policy question: what’s Exegol’s preferred approach for installing/packaging tools?
Right now it feels a bit random/contributor-dependent, and I’m wondering if we should align on a default rule.
Option: A Prefer official releases (tags/packages)
Pros
Cons
Option B: Track main/master (or latest commit)
Pros
Cons
Questions
Do you have a preferred default (A vs B)?
Longer-term idea: consider pinning a specific commit SHA per tool (even when not sourcing from git), then upgrading tools individually via small, automated PRs. Each PR would bump one tool to a newer commit/version, run the build + basic smoke tests, and if it breaks, it’s easy to revert/pin back; similar to Dependabot’s workflow.
If you could automate this, it would be really cool: you keep Exegol stable and reproducible while still getting "daily updates" in a controlled, CI-validated way.