undefined | Better HN

0 pointspxc3y ago0 comments

If you want to package an application which depends on a library, you have to package the library, too. This is the (pretty much sole) reason that distros package libraries.

From a technical perspective it's pretty much a solved problem for any language ecosystem whose dependency management is reproducible, is uniform enough to support basic automation, and supports some measure of vendorization.

0 comments

guhidalg3y ago

IME (and I worked at Microsoft previously), Nuget and MSBuild have decided that application developers should have full control of their dependencies and that system administrators can override these things but not easily. I understand that distro-level package manager want to make it possible to upgrade a system library for all applications, but the .NET world isn’t going in that direction (yes yes I know about the GAC et al. but that’s more trouble than it’s worth)

The implicitly assumption in the .NET choice is that dependencies may not be backwards compatible, so compile against a specific version and go ahead and ship that assembly in your self-contained deployment. Yes your packages are bigger, but disk space and bandwidth are cheaper than developer time and support costs.

pxcOP3y ago

Application developers can still pin their in-ecosystem library dependencies to exact versions and have downstream, distro-level package managers respect that while building everything from source and making the system package manager aware of all of those library versions in more or less the usual way. (That's how building Rust and Go applications already works on NixOS, for example.)

That's why I say it's largely a solved problem for language ecosystems that tick a few basic boxes.

Can't Nuget and MSBuild support this? Can they not dump lockfiles like common build tools for Rust, Go, Javascript, Haskell, Python, Nim, PHP, etc., do? Is there a general problem (like there is with Java) where actually building from source is so difficult that it is rarely done?

Anyway there's already a suite of Linux packaging options built around the kind of app distribution model Microsoft expects, and Canonical even has one of their own! I don't see why they wouldn't support distributing .NET applications as Snaps, or maybe even automating the creation of Snap packages for .NET applications.

guhidalg3y ago

There is no immediate problem with building from source, there simply isn't much of a benefit to doing so. An assembly compiled with different optimizing C# compilers will be virtually identical assuming the source files are identical. I can think of a reason not to compile from source: it's essentially statically linking code into your assembly which can be huge problem for middleware packages that want to override the specific version you depend on. This is very common with the JSON serialization library, which is highly backwards compatible.

I think historically in the .NET world, package consumers have expected pre-compiled assemblies and not source code and so that's what the ecosystem has developed around.

1 more reply

int_19h3y ago

> If you want to package an application which depends on a library, you have to package the library, too.

You don't have to. You can package the application together with the right version of the library, as a single package.

j / k navigate · click thread line to collapse

0 comments

guhidalg3y ago

pxcOP3y ago

That's why I say it's largely a solved problem for language ecosystems that tick a few basic boxes.

guhidalg3y ago

I think historically in the .NET world, package consumers have expected pre-compiled assemblies and not source code and so that's what the ecosystem has developed around.

1 more reply

int_19h3y ago

> If you want to package an application which depends on a library, you have to package the library, too.

You don't have to. You can package the application together with the right version of the library, as a single package.

j / k navigate · click thread line to collapse