Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Writing a Package Manager

antonz.org

Post reply on HN
Print view View original

21–30 of 106 posts

Re: Writing a Package Manager

#21

Post by mijoharas »

It's surprisingly to me that no-one has built a asdf style package manager. (I'm not talking about system package managers, their language software packages are always out of date and get installed globally instead of locally to a project).

Having a unified interface to a package manager per language that will use the languages registry could be really nice (I guess you'd have some core dependency management functions and agnostic ways to store and download the packages, and plugins per language that would use these common building blocks to actually do stuff?).

Another advantage of this could be cross language dependencies which often aren't handled well by package managers.

Re: Writing a Package Manager

#23

Post by ojkelly »

deepsun wrote: post #14

Sounds like Maven had all this solved many years ago. Yes, it cannot run arbitrary code, like NPM does, it just copies files, but the dependencies and specfiles were there from the beginning.

Not running arbitrary code is a feature, that yarn brings back to the js ecosystem.

It sounds nice in theory, but it impacts the soundness of the whole system.

Re: Writing a Package Manager

#24

Post by larusso »

friendzis wrote: post #17
larusso wrote: post #8

Awesome post! I worked with a bunch of package managers over the years and one can see that this design got inspired by the hood parts of a few I know. The only design part I don‘t really like is the ‚latest‘ version specifier in the spec file. Which moves the declaration what the latest version is to the hosted location (in the example GitHub via GitHub API) paired with the fact that the checksums are also fetched r…

Probably the simplest version of a "package manager" are git submodules. Pointing submodule to `master` is effectively the same thing as pointing a "real" package manager to `latest`. This is trunk based development, however you implement it. One could easily argue that floating versions are considered harmful for releases outside of development team and should always be pinned, but on the other hand it is hard to ar…

Brew has the —head flag where one can instruct to build the latest commit from the repo. But the spec/Formular needs to set a head to pull from.

Re: Writing a Package Manager

#25

Post by brabel »

The author added a lockfile without understanding why they exist.

A lockfile is meant to "freeze" dependency version resolution when package authors can specify dependencies on other packages using version ranges... it also "freezes" choices of transitive packages' versions when different packages depend on the same one, but with different versions.

They chose to not handle package dependencies at all, and I believe there's no version ranges either, so I really don't see why they added a lockfile.

Re: Writing a Package Manager

#26

Post by pharmakom »

brabel wrote: post #25

The author added a lockfile without understanding why they exist. A lockfile is meant to "freeze" dependency version resolution when package authors can specify dependencies on other packages using version ranges... it also "freezes" choices of transitive packages' versions when different packages depend on the same one, but with different versions. They chose to not handle package dependencies at all, and I believe…

A version number is just a label, and labels are mutable. A lock-file containing hashes will always resolve to the same packages (or fail).

Re: Writing a Package Manager

#28

Post by pmontra »

salawat wrote: post #20
nextaccountic wrote: post #10

Earlier quoted context omitted.

> Apple already uses something like this today Some Linux distros too have things like this but unfortunately there is no buy-in across the ecosystem so "sandboxing" is done in a half-baked way. The problem is when applications in general aren't written with sandboxing in mind, and when you have to choose between apps not working properly or having a leaky sandbox, you will opt for the latter. I wish some big corp bi…

Hard pass. I don't need Microsoft securing my calculator from me, thank you very much. If I need it that badly, I'll build it myself.

My calculator is bc -l in a terminal but I'd bet that there are calculator apps with network access to display ads, sync to the same app on other devices, save past calculations to the cloud, and get plugins.

I found one with some of those features and some more, with only one minute of googling https://apps.apple.com/us/app/graphcalcpro2go/id1091870099

That's for iOS but why not on Windows or Android? I'd be surprised to find one like that on Linux.

Re: Writing a Package Manager

#29

Post by matharmin »

riffraff wrote: post #22

Isn't this missing the SQLite version? Are SQLite extensions guaranteed to work across different SQLite installs?

SQLite is quite good at staying backwards compatible, and this includes the APIs exposed to extensions, but extensions could definitely have a minimum SQLite version.

Re: Writing a Package Manager

#30

Post by [deleted] »

brabel wrote: post #25

The author added a lockfile without understanding why they exist. A lockfile is meant to "freeze" dependency version resolution when package authors can specify dependencies on other packages using version ranges... it also "freezes" choices of transitive packages' versions when different packages depend on the same one, but with different versions. They chose to not handle package dependencies at all, and I believe…

[deleted]
Post reply on HN