Hacker News new | past | comments | ask | show | jobs | submit login

Ugh. Language-based package managers are one of the biggest misfeatures of the millenium. They're all well and good* until they have to interact with the world outside their language universe.

* I'm being very generous here.




There is an important distinction to make between package managers and project managers.

In Ruby, for example, Bundler is what I would call a project manager. It installs packages to a place only it knows (or it should know) about, and Bundler or tools that integrate with Bundler wrangle the Gem loader path to control what modules are available to load.

This way the dependencies of any number of project live in complete isolation from one another, including several different versions of the same dependency which is often impossible to achieve using a system package manager like apt or pacman. The end result is similar to something like virtualenv, but with (in my opinion) a friendlier user experience.

These project managers also often include project scaffolding tools and subcommands to run tests, generate documentation, etc. Examples in other languages include Leiningen or Boot for Clojure, Maven for Java, and Cargo[1] for Rust. When used properly and when the creators of a project manager understand its role, they can work in concert with a system-level package manager. Cargo, for example, interoperates beautifully with system packages with great support for linking with system libraries[2].

[1]: http://crates.io/

[2]: http://doc.crates.io/build-script.html#case-study:-linking-t...


Hm... Can you elaborate? I have nothing but good things to say about PIP (the only package manager I've used extensively).


My problem with pip: It requires a gcc compiler to implement most major packages, which is not a tool you want to actually have installed on the target servers.

You can do additional work to pre-build wheels or packages, but then you're stepping outside of the python and pip world and into maintaining your own repos and build servers and...


I would double your question except pip is a really bad example. There are many problems with it, pretty well known inside the python community and discussed many times, so I won't repeat all that can be found on the internet quite easily. In fact, package managers in python are pretty ugly story in general, every new generation of them being long and painful attempt to fix problems of the previous one, but unfortunately introducing the new ones.

npm would be a much better example, however not perfect as well. Actually, I would say all package managers we have are quite imperfect, but it's more of a existing implementations problem, not a package manager problem in general.

I mean, yeah, it would be nice if we all just started using guix or something, and wouldn't need language-specific package managers anymore, but it's not happening yet, right? And we have to live somehow until it does. And if I need to use language-specific package manager to be able to install a library that has a new version with crucial fixes on github since yesterday, and the version apt-get suggests is two years old — well, I'd better be using language-specific package manager. Still better than compiling it manually collecting dependencies all over the world over the next few hours.


the world outside would be, e.g. system libraries. Python package X depend on libxml-foo or libmagick-bar-6.6.7..


Either I've never used Python libraries that would need external libraries, or PIP installs those as well. I definitely know that it can compile code as well, e.g. for installing Numpy/Pandas.


It does not. To keep to the scientific python examples you mentioned: It is a pain to install `matplotlib` with pip if you do not have the C libraries for image compression. (Still, I like pip+virtualenv quite a bit, but they are definitely insufficient when C modules are involved).


It's frustrating having the proliferation of different package managers.

Each one can work well in isolation; but when you then need to integrate with your platform package manager or another language's package manager, you get a combinatorial explosion of possible interactions.

One example that I've been particularly frustrated by recently is Python/Emacs integration. I have Emacs and Python installed via my system package manager (apt). Then there are a bunch of Emacs modes that I need to install via the Emacs package manager (elpy and its dependencies). Those in turn have dependencies on Python packages (rope/flake8). And finally I have a bunch of different python packages that I work on that are all linked to from a virtualenv so that they'll all resolve properly in all of those tools.

If I upgrade one part of that system (apt, emacs packages, python packages), it frequently breaks other parts, because there aren't any proper dependencies between them. I then have to spend a while fiddling with the whole setup to get it back up and running again.

Basically, the more package managers you have, the less value they have. The whole point of package managers is to manage a whole set of packages together, so you don't have to manually go through and resolve all of the dependencies yourself, manually figure out which version of this package goes with what version of that package. But every time there is some dependency between two different package managers, that breaks down.

Another part of the frustration is that they are all basically doing the same thing, but with slightly different implementations. In the end, a package manager's purpose is to let you figure out which packages you need, by resolving dependencies while honoring version constraints, fetch those packages from an archive somewhere (and verify that they are intact and haven't been tampered with), unpack them and install the files in the right places, and run some glue code to set up indexes, documentation, and so on appropriately. The only part of that task which really needs to differ between package managers is that glue code, plus the policies for inclusion in the centralized archive; everything else is basically solving the same problem in a whole bunch of slightly different ways (different ways of representing and comparing version numbers, different ways of verifying package integrity, different ways of doing local mirrors, etc), and so you get a whole bunch of incompatible and differently buggy implementations of the same kinds of things, or some functionality just missing from certain package managers.

What I would really like to see is a single unified package manager core, that handles all of the basic functionality that they all set out to solve, with the ability to utilize multiple different repositories (so that different projects could have their own policies for inclusion and sets of packages that are designed to work together), and appropriate places to hook in all of the language (or distro) specific glue that you need. I've been mulling over trying to write such a package manager, but of course when doing so you need to be careful or you will run into this problem: https://xkcd.com/927/


I agree with you in theory, but in practice the existing package managers are simply not suitable for the new languages (too fragmented, walled gardens, not powerful enough), so language designers really don't have any other solution except making their own manager. Ideally, though, a language's package manager would integrate nicely with the system's package manager and would know how to automatically install other packages.


Oh, I know why it keeps on happening, but it leads to a frustrating and fragmented experience. That's why it would be nice to have a common core package manager, that handles all of the tasks that any package manager will need to handle (metadata, versions, dependencies, dependency resolution, conflicts, features, fetching packages, verifying packages, managing an archive of packages, etc), plus the ability to hook in at appropriate places to provide the distro or language specific hooks necessary, and the ability to have cross-archive dependencies (including union dependencies like "either these three Debian packages, these two Fedora packages, or this Homebrew package"). That would then let you focus on solving the common problems in one place, and leave each language or distro to only have to focus on its own particular glue and policies.


Try installing numpy and scipy.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: