So you want to write a package manager

Re:So you want to write a package manager by wslh on Saturday February 13, 2016 @06:27PM (#11096221)

One important issue that gave me a headache in the past (at least for NPM) is the reproducibility factor. You can't reproduce an installation using NPM.

That's because with NPM you can install a specific version of module A on time t0 that also installs, based on package.json, the latest version of module B. But on t1 there is a new version of module B, so the new installation of the same version of module A ends up having a different version of module B. Obviously, this problem expands dramatically when you use multiple modules with different degrees of depth.

Hopefully mook pointed about the mention of shrinkwrap in the article.

[ Parent | on HN ]

Re:So you want to write a package manager by mook on Saturday February 13, 2016 @06:45PM (#11096278)

npm-shrinkwrap [1] (mentioned in the article) is supposed to help with this; it makes a lock file (npm-shrinkwrap.json) that records the resolved version.

I think it got started being used at work (by stuff I wasn't working on) because trying to install old code that hasn't changed broke because some HTTP proxying middleware for Express changed APIs or something.

[1]: https://docs.npmjs.com/cli/shrinkwrap

[ Parent | on HN ]

Re:So you want to write a package manager by sdboyer on Saturday February 13, 2016 @07:34PM (#11096465)

fwiw, folks on twitter suggested to me that npm may be moving in something like my "sync-based PDM" direction:

https://twitter.com/rebeccaorg/status/698370989386694657

[ Parent | on HN ]

Re:So you want to write a package manager by davnicwil on Saturday February 13, 2016 @06:37PM (#11096254)

Whilst this is true, it's clearly bad practice to have a 'latest' dependency in any module that is itself designed to be depended upon.

Personally I've never seen this be a problem in practice. Possibly because I'm lucky, possibly because I've only used dependencies that don't do this. Since I mostly use quite popular libraries, and check the dependencies of the more niche ones I decide to use for exactly things like this, I think the latter is probably the case.

Out of curiosity, I wonder if anyone here has hit this problem in practice with npm and could provide a concrete example - in particular with popular open source dependencies?

Yes it's a possible problem in theory, but a lot of problems in software are possible in theory but rarely occur in practice because people follow sensible patterns to guard against them.

[ Parent | on HN ]

Re:So you want to write a package manager by streptomycin on Saturday February 13, 2016 @07:19PM (#11096415)

I hit it with an unpopular package (like 10 stars on Github). A dependency of a dependency slightly changed its API in a patch release. Fun debugging. So glad we have this auto-install-newer-untested-versions feature as default.

[ Parent | on HN ]

Re:So you want to write a package manager by wslh on Saturday February 13, 2016 @06:53PM (#11096313)

I was one of the "lucky" people who experienced this. The main module was bitcore-wallet-client

[ Parent | on HN ]