Discussed at the time: https://news.ycombinator.com/item?id=11088125

The article may say that an SPM is "not why we are here today" but writing any package manager is 1) phenomenally difficult and 2) has incredible risk to system integrity and security. You could do worse that starting out with reading and understanding RPM (https://github.com/rpm-software-management/rpm) or dpkg (https://git.dpkg.org/cgit/dpkg/dpkg.git).

I wonder if language designers will take package management into more consideration in the future. For example, what if every library's version was included in the module name during compilation. So you automatically go from MyLibrary.my_function() to MyLibrary::V1.0.0.my_function() after compiling the code. This way you could easily run different versions of the same library in dependencies without dealing with the headaches that normally causes. The only additional restriction I would add is that you have to use an exact version of a library instead of giving the package manager discretion.

Has anyone tried to implement something like that in a language?

If I understand you correctly, this is what Rust/Cargo currently do. You can have multiple versions of the same library in transitive dependencies, and it will link them all into the same binary using a name mangling scheme similar to what you describe.

https://stackoverflow.com/questions/51714866/

Java apparently has a solution, named ‘shaded dependency’: https://softwareengineering.stackexchange.com/questions/2972... The name seemingly stems from the Maven plugin: https://maven.apache.org/plugins/maven-shade-plugin/

JS sidesteps the issue by having imported modules as local variables, and thus modules may have different versions of dependencies by simply dropping different files in the hierarchy. In theory this should also be possible in Python, but PyPI modules are usually installed as shared dependencies there.

I believe .net works like that, more or less, although the libraries ("assemblies") are not statically linked. Assemblies declares a dependencies on a particular version of an assembly. It is possible to override this in a configuration file, so you "redirect" to a newer version.

There is a lot there but it’s pretty hard to maintain. Visual Studio has a tendency to sometimes upgrade references automatically. I have seen it now several times that a project has been set up with the correct references, then somebody else opens the project, saves, and now everything is changed. Makes me sometimes get nostalgic about make files. It took a while to build them up manually but then they were stable. With Visual Studio there is too much “intelligence” and wizardry going on behind the scenes.

On platforms with ELF binaries that works with any language and symbol versioning already.

Counterpoint: https://michael.stapelberg.ch/posts/2019-08-17-introducing-d...

That... is not a counterpoint?

In summary: use system package managers and not language package managers. Rely on a stable and trusted distribution.