<p>Vendoring is the concept of downloading/installing a specific version of dependencies and making it available elsewhere (typically, within a local repo/folder of your supporting application)</p>

<p>Vendoring is usually done to prevent breakage occurring when dependences are no longer available. Vendoring also prevents your applications from breaking when dependencies are no longer available( for ex: the <a href="https://www.reddit.com/r/programming/comments/4bjss2/an_11_line_npm_package_called_leftpad_with_only/" rel="nofollow noreferrer">leftpad incident</a>)</p>

<p>For example, let's consider you have your Chef cookbook that depends on another third party cookbook, say mysql2 chef gem. Now while mentioning in your <code>metadata.rb</code>, you didn't pin the version or vendor the cookbook. Lets consider the cookbook has had a version upgrade, breaking all previous APIs. The previous versions have also been taken down. In such a case, your cookbooks are suddenly broken as well and if you have a urgent deploy, your Chef run will fail.</p>

<p>Vendoring prevents this by making available the dependency on your local chef server, so even if the dependency has gone ahead, you can continue referring to the previous version and your cookbook will not break</p>

<p>(Also goes without saying, you must keep updating the dependencies and cookbooks, else you might get bit with some bad bugs)</p>

CC BY-SA 3.0
2017-06-05T16:35:46.837Z
Vendoring also protects you if the upstream repository disappears entirely.
Jason Martin
CC BY-SA 3.0
2017-06-05T17:55:04.847Z
@JasonMartin hah I started with the intent of posting about that and completely forgot about it! thanks for the reminder, will add that in
Sathyajith Bhat
CC BY-SA 3.0
2017-06-05T11:38:00.773Z
2017-06-06T08:01:30.227Z
2017-06-06T08:01:30.227Z
Sathyajith Bhat
<p>In various tools there is the concept of "vendoring". i.e. Ruby's bundle, and Chef's Berkshelf.</p>

<p>"vendor" is not a verb and in documentation it's often assumed that I know what it means. Can someone help shed some light on what it is and the benefits of doing it.</p>

<terminology><chef>
Vendoring - what is it?
Tom Duckering
# Vendoring - what is it?

(Asked by: username_0 on 2017-06-05)

In various tools there is the concept of "vendoring". i.e. Ruby's bundle, and Chef's Berkshelf.

"vendor" is not a verb and in documentation it's often assumed that I know what it means. Can someone help shed some light on what it is and the benefits of doing it.

**Tags:** terminology, chef


---

## 1 answers

### Answer by username_1 on 2017-06-05. Score: 7

Vendoring is the concept of downloading/installing a specific version of dependencies and making it available elsewhere (typically, within a local repo/folder of your supporting application)

Vendoring is usually done to prevent breakage occurring when dependences are no longer available. Vendoring also prevents your applications from breaking when dependencies are no longer available( for ex: the [leftpad incident](https://www.reddit.com/r/programming/comments/4bjss2/an_11_line_npm_package_called_leftpad_with_only/))

For example, let's consider you have your Chef cookbook that depends on another third party cookbook, say mysql2 chef gem. Now while mentioning in your `metadata.rb`, you didn't pin the version or vendor the cookbook. Lets consider the cookbook has had a version upgrade, breaking all previous APIs. The previous versions have also been taken down. In such a case, your cookbooks are suddenly broken as well and if you have a urgent deploy, your Chef run will fail.

Vendoring prevents this by making available the dependency on your local chef server, so even if the dependency has gone ahead, you can continue referring to the previous version and your cookbook will not break

(Also goes without saying, you must keep updating the dependencies and cookbooks, else you might get bit with some bad bugs)

> **Comments:**
> **username_2**: Vendoring also protects you if the upstream repository disappears entirely.  
> **username_1**: @JasonMartin hah I started with the intent of posting about that and completely forgot about it! thanks for the reminder, will add that in  

---

