Package management is a wicked problem

Andrew has been writing a ton of interesting blog posts related to package management (https://nesbitt.io/posts/). He's had some great ideas, like testing package managers similar to database Jepsen testing.

Repositories require at least one but probably multiple additional semantic layers and client side filtering that can take advantage of it. Otherwise all you have is a large uncurated catalog with a "take it or leave it" strategy for clients.

There was a time when this was sufficient. We've moved well past that point.

cargo works because rust was young enough to be opinionated. try that with npm and enjoy your mass exodus to the next thing that will also betray you

"but bun!" — faster shovel, same hole

I like that the author calls out the naming overloading, cause when I hear package management I think `pacman winget and apt`

Naming things, cache invalidation, and off-by-one errors: package management heavily emphasizes the hardest ‘blue-collar’ problems in CS.

Is it not curious that languages known for their rigor have solid package manager/build tools while the remakning languages do not?

This is not a technical problem. It’s a cultural one.

This all just sounds like problems we see when making new features, of any sort, for customers. A feature is never objectively done, there are many opinions on its goodness or badness, once it’s released its mistakes can last with it, etc.

If this is a wicked problem, then so is much of other real-world engineering.

Honestly just look at the dismal history of Python and package management. easy_install, setuptools, pip(x), conda, poetry, uv. Hell I might even be missing one.

All this, and yet package management is still so much better than managing software any other way, and there are continually real advancements both in foundations and in UX. It is indeed full of wicked problems in a way that suggests there can be no clear "endgame". But it's also a space where the tools and improvements to them regularly make huge positive differences in people's computing experiences.

The uneven terrain also makes package managers more interesting to compare to each other than many other kinds of software, imo.

It is and isnt.

Version hell is a thing. But Nix's solution is to trade storage space for solving the version problem.

And I think its probably the right way to go.

so what is the "best" package manager humankind have right now ?????

I dont really agree. Package management has a number of pretty well defined patterns (e.g. lockfiles, isolation, semver, transactionality, etc) which solve common use cases that are largely common across package management.

It is unfortunately one of the most thankless tasks in software engineering, so these are not applied consistently.

This was symbolized quite nicely by google pushing out a steaming turd of a version 1 golang package management putting while simultaneously putting the creator of brew in the no hire pile coz he couldnt reverse a binary tree.

In this respect it is a bit like QA - neglected because it is disrespected.

What makes it seem like a wicked problem is probably that it is the tip of the software iceberg.

It is the front line for every security issue and/or bug, especially the nastiest class of bug - "no man's land" bugs where package A blames B for using it incorrectly and vice versa.

apt-get solved this 'problem' like 25 years ago.