News for hackers. Stuff that matters.
Re:Finding Critical Open Source Projects by mbakke on Friday December 11, 2020 @09:31AM (#25386180)
One cool feature of functional package managers such as Nix and Guix is that the dependency graphs are entirely transparent and can be inspected programmatically.

I wrote a script that lists the number of dependents for each package in Guix by traversing the package graphs:

https://gist.github.com/mbakke/f354272666fbef09c5229f7b85377...

Running it takes about 16 seconds on my laptop, and piping to 'grep -v bootstrap | sort -rn | tail -n 20' gives:

  16695 guile
  16692 ld-wrapper
  14686 pkg-config
  14512 perl
  14444 ncurses
  13135 readline
  13133 zlib
  13022 libffi
  12470 xz
  12448 libunistring
  12433 openssl
  12353 bash
  12050 libxml2
  12016 gettext-minimal
  11950 tar
  11942 bzip2
  11896 expat
  11857 tzdata
  11850 net-base
  11846 python-minimal
(GCC, glibc and binutils are missing for complicated reasons, but should be up there with Guile)

By changing (all-packages) on line 26 to:

  (fold-packages (lambda (package result)
                   (if (string-prefix? "python-" (package-name package))
                       (cons package result)
                       result))
                 '()))
We get the most popular Python projects:

  6672 python-setuptools-scm
  6667 python-nose
  6662 python-pyparsing
  6662 python-more-itertools
  6661 python-wcwidth
  6660 python-py
  6660 python-pluggy
  6660 python-atomicwrites
  6657 python-six
  6593 python-mock
  6587 python-appdirs
  6586 python-lxml
  6584 python-filelock
  6584 python-distlib
  6583 python-sortedcontainers
  6580 python-hypothesis
  6577 python-elementpath
  6576 python-xmlschema
  6575 python-pytest
  6303 python-libxml2
This approach misses "end user" packages such as browsers and QEMU, but provides some insight into high value targets.

For end user packages, Debians "popularity contest" can be useful:

https://popcon.debian.org/

Re:Finding Critical Open Source Projects by lkcl on Saturday December 12, 2020 @04:48PM (#25402043)
analysing a source-only-based distro (one where the compiler is required as a dependency) should make the importance of the compiler(s) clearer.

source-only distros include macports, gentoo, and so on.

Re:Finding Critical Open Source Projects by mbakke on Monday December 14, 2020 @05:41AM (#25415517)
Guix and Nix _are_ source-based distros. They just happen to have a facility for transparently downloading "binary substitutes" for local builds.

The graphs I'm traversing are the build-time dependency graph of all packages. I could also traverse run-time dependency graphs, but then I'd need to actually build all the things, because those are not known up-front unlike Gentoo and Macports.

The reason the toolchain is missing is because it is an "implicit input" as opposed to a "normal" input, so it's invisible/transparent to the query I'm making.