←back to thread

A critique of package managers

(www.gingerbill.org)
109 points gingerBill | 10 comments | 08 Sep 25 12:18 UTC | HN request time: 0.001s | source | bottom
Show context
NoboruWataya ◴[08 Sep 25 13:37 UTC] No.45168116[source]▶
I see this a lot with Rust where I will depend on one or two external crates for a simple application and then I am shocked to see dozens of dependencies being pulled in when I go to build. I actually think Cargo's support for feature gates and conditional compilation could in theory be a strong mitigation against this as crates can avoid pulling in dependencies unless you actually need a feature that relies on them, but in practice it doesn't seem to work that way as I often see these complaints about Rust.

I sympathise with the arguments but IMO laziness will always win out. If Rust didn't have Cargo to automate dependency hell, someone would create a third party script to fill the gap.

replies(3): >>45168261 #>>45168360 #>>45168912 #
1. account42 ◴[08 Sep 25 14:40 UTC] No.45168912[source]▶
> If Rust didn't have Cargo to automate dependency hell, someone would create a third party script to fill the gap.

Possibly but not guaranteed. Some other languages without a built in package manager haven't had an external one manage to take over the ecosystem, most (in)famously C and C++, while others have.

replies(3): >>45170401 #>>45175519 #>>45175524 #
2. alexvitkov ◴[08 Sep 25 16:35 UTC] No.45170401[source]▶
Most language users will follow the "spirit" of the language - e.g. Bill is against package managers, people who use his language mostly agree with his ideas, and there's not a huge standard Odin package manager.

I rather appreciate that C and C++ don't have a default package manager that took over - yes, integrating libraries is a bit more difficult, but we also have a lot of small, self-contained libraries that just "do the thing" without pulling in a library that does colored text for logging, which pulls in tokio, which pulls in mio, which pulls in wasi, which pulls in serde, which is insane.

replies(1): >>45174150 #
3. 1718627440 ◴[08 Sep 25 21:20 UTC] No.45174150[source]▶
C and C++ do have package managers. It's just that these languages evolved for OS implementation and also that these package managers are old and stable so they have support for a lot of languages, so that you probably know them as OS package managers.
replies(1): >>45175148 #
4. cozzyd ◴[08 Sep 25 22:50 UTC] No.45175148{3}[source]▶
Which is the correct thing to do as things written in language X can depend on things written in language Y.
5. ◴[08 Sep 25 23:34 UTC] No.45175519[source]▶
6. Macha ◴[08 Sep 25 23:35 UTC] No.45175524[source]▶
The package manager for C/C++ is apt, or rpm, or whatever package manager your system uses. These package managers were designed for the world of C/C++ software so it's less surprising that these languages haven't found as much of a push towards language package managers.
replies(2): >>45175766 #>>45178830 #
7. skydhash ◴[09 Sep 25 00:07 UTC] No.45175766[source]▶
It is not. Most distro have their own build scripts that target the specific library name that is needed. Dependencies is mostly done through a mix of convention, helper programs/scripts and compiler args.
replies(1): >>45178120 #
8. 1718627440 ◴[09 Sep 25 06:22 UTC] No.45178120{3}[source]▶
Most distros have their own package manager including source packages and an automated way to go from there to binaries. So the build scripts you mention are part of the package manager.
9. account42 ◴[09 Sep 25 07:49 UTC] No.45178830[source]▶
Yes, but that's quite different from how language package managers are used. A typical C/C++ project doesn't tell you to build it via apt/rpm instead you are expected to provide the dependencies using whatever means you choose or they are included in the repo. This means you don't need to fight a package manager to get fully offline or reproducible builds for example.

RPM and APT packages are also usually not maintained by the upstream developer but by distro developers who care about making different packages work together so you don't get the dependency hell problem as a user.

replies(1): >>45189041 #
10. 1718627440 ◴[09 Sep 25 21:00 UTC] No.45189041{3}[source]▶
Yes, C programs go to lengths to give the user choice. But it is recommended to use source packages for e.g. dpkg. And it's not too rare to have the .debian directory in the original VCS.