8 ms·

CMake is not a package manager or package repository, though. CMake can discover libraries and it can build your code, but that assumes you've already fetched a

CMake is not a package manager or package repository, though. CMake can discover libraries and it can build your code, but that assumes you've already fetched a dependency somehow. Sure, you can use system package managers, but these are different on every platform. I've been writing a simple video game in C++ recently, using CMake to build. I wrote a little bit of code that fetches the few libraries I need in order to have a complete/deterministic build process that works on linux/windows/mac. It lets me change versions (by specifying a new url to a source tarball). Versioned dependency management is so typical and convenient in many other languages and is such a pain in the butt with C++ because CMake is this thing that's sort of good enough. But my CMake experience doesn't compare well at all with maven, pip, gem, cargo, or even npm.

lmitchell 9y ago
Yep, I'm a huge fan of this for this reason. I've spent a lot of time in my life messing around with cmake, scons, custom bash scripts... you name it, trying to get around C++'s shitty dependency management. And then recently I picked up Ruby, for the first time in a year or two, to write a little chat bot... 'gem install' is flawless across my Windows desktop and my Linux laptop, easy to depend on a specific version, easy to upgrade, etc. Tbh I'm pretty jealous. e: does anyone know if this has any relation to Boost's b2? I know that was originally based off of jam which is not related but the name is so similar I can't help but think I'm missing something :(
- suby 9y ago
  'gem install' hasn't worked flawlessly in my experience (on both Windows and Linux). It's more likely than not that I'll have a gem fail to install on me due to some dependency or configuration issue. It's consistent and frustrating enough where I shy away from Ruby now. I like Ruby more than Python as a language, but I will say that I've never had pip fail to install a dependency on me.
  - derefr 9y ago
    A lot of Ruby libraries just happen to use native extensions that rely on OS-packaged libraries being installed. I'm surprised there isn't any part of the gem process that calls `pkg-config`, to verify if a gem will be able to install, given its native dependencies. Having `bundle install` bail out after just a second with "please install libfoo first" would be great, especially for CI. > I've never had pip fail to install a dependency on me `pip install` has never failed me, but `pip install --upgrade` fails for me quite a bit. Especially when I try to use it like `gem upgrade`, with a stanza like pip list --outdated --format=legacy | cut -d' ' -f1 | xargs pip install --upgrade
    - pjmlp 9y ago
      Maybe because `pkg-config` is mostly a GNU/Linux thing?
      - pfultz2 9y ago
        pkg-config works on windows with visual studio as well.
        pjmlp 9y ago
        What about IBM i, z/OS, ClearPath, INTEGRITY OS, Solaris, HP-UX, Tru64, Aix, ..... ?
  - paulddraper 9y ago
    The problematic parts of gem/pip install are....the C parts.
    - flukus 9y ago
      And if they were installed from a gem how long do you think it would take for security patches to be applied for every install? Image magick is a popular gem plugin on look at the vulnerabilities: https://www.cvedetails.com/vulnerability-list/vendor_id-1749/Imagemagick.html https://www.cvedetails.com/vulnerability-list/vendor_id-1749...
lantastic 9y ago
Conan (https://conan.io/ https://conan.io/) tries to tackle the package management for C/C++.
- ioquatix 9y ago
  I maintain and use http://teapot.nz http://teapot.nz for development. It's made my life so much better - it's designed for developers.
  - lantastic 9y ago
    Nice, I will definitely try it out!
    - ioquatix 9y ago
      Thanks, I'd love any and all feedback. I use it almost daily and my goal is to make it as awesome as possible!
- epage 9y ago
  While Conan still has some room to grow, I love the approach they take to package management for C++. Too many C++ tools couple package management and build which increases their adoption cost and makes it more work to package third part packages. Conan takes the approach of managing dependencies and then giving your build system of choice the information it needs to access those dependencies via conan plugins. I think I had read that the author of Conan was involved in biicode and that the third party packaging problem is what inspired him to create Conan. Some other cool things about conan - Can be used for more than C++ - SCM independent - Artifact caching - Options allow clients to customize your package (creates distinct artifact) - Scopes allow developers to modify your build (like conditional build steps so doesn't create a distinct artifact) Some things I think can be improved - Needs to separate out dependency lock file like Cargo or Poet - Build tools need to be packaged in Conan for tracability / reproducibility - Plugins are in Python which is heavy for deployment and has a large compatibility surface - Easy to hit limits of declarative dependency files, being forced into implementing them in Python (see above) - Project templates are hard coded.
pfultz2 9y ago
Actually cget can install packages directly from cmake packages(or other build systems). There is also the cmake-get module which can install cget recipes directly in the cmake without needing cget or python installed.

lmitchell 9y ago

Yep, I'm a huge fan of this for this reason. I've spent a lot of time in my life messing around with cmake, scons, custom bash scripts... you name it, trying to get around C++'s shitty dependency management. And then recently I picked up Ruby, for the first time in a year or two, to write a little chat bot... 'gem install' is flawless across my Windows desktop and my Linux laptop, easy to depend on a specific version, easy to upgrade, etc. Tbh I'm pretty jealous. e: does anyone know if this has any relation to Boost's b2? I know that was originally based off of jam which is not related but the name is so similar I can't help but think I'm missing something :(

suby 9y ago
'gem install' hasn't worked flawlessly in my experience (on both Windows and Linux). It's more likely than not that I'll have a gem fail to install on me due to some dependency or configuration issue. It's consistent and frustrating enough where I shy away from Ruby now. I like Ruby more than Python as a language, but I will say that I've never had pip fail to install a dependency on me.
- derefr 9y ago
  A lot of Ruby libraries just happen to use native extensions that rely on OS-packaged libraries being installed. I'm surprised there isn't any part of the gem process that calls `pkg-config`, to verify if a gem will be able to install, given its native dependencies. Having `bundle install` bail out after just a second with "please install libfoo first" would be great, especially for CI. > I've never had pip fail to install a dependency on me `pip install` has never failed me, but `pip install --upgrade` fails for me quite a bit. Especially when I try to use it like `gem upgrade`, with a stanza like pip list --outdated --format=legacy | cut -d' ' -f1 | xargs pip install --upgrade
  - pjmlp 9y ago
    Maybe because `pkg-config` is mostly a GNU/Linux thing?
    - pfultz2 9y ago
      pkg-config works on windows with visual studio as well.
      - pjmlp 9y ago
        What about IBM i, z/OS, ClearPath, INTEGRITY OS, Solaris, HP-UX, Tru64, Aix, ..... ?
- paulddraper 9y ago
  The problematic parts of gem/pip install are....the C parts.
  - flukus 9y ago
    And if they were installed from a gem how long do you think it would take for security patches to be applied for every install? Image magick is a popular gem plugin on look at the vulnerabilities: https://www.cvedetails.com/vulnerability-list/vendor_id-1749/Imagemagick.html https://www.cvedetails.com/vulnerability-list/vendor_id-1749...

lantastic 9y ago

Conan (https://conan.io/ https://conan.io/) tries to tackle the package management for C/C++.

ioquatix 9y ago
I maintain and use http://teapot.nz http://teapot.nz for development. It's made my life so much better - it's designed for developers.
- lantastic 9y ago
  Nice, I will definitely try it out!
  - ioquatix 9y ago
    Thanks, I'd love any and all feedback. I use it almost daily and my goal is to make it as awesome as possible!
epage 9y ago
While Conan still has some room to grow, I love the approach they take to package management for C++. Too many C++ tools couple package management and build which increases their adoption cost and makes it more work to package third part packages. Conan takes the approach of managing dependencies and then giving your build system of choice the information it needs to access those dependencies via conan plugins. I think I had read that the author of Conan was involved in biicode and that the third party packaging problem is what inspired him to create Conan. Some other cool things about conan - Can be used for more than C++ - SCM independent - Artifact caching - Options allow clients to customize your package (creates distinct artifact) - Scopes allow developers to modify your build (like conditional build steps so doesn't create a distinct artifact) Some things I think can be improved - Needs to separate out dependency lock file like Cargo or Poet - Build tools need to be packaged in Conan for tracability / reproducibility - Plugins are in Python which is heavy for deployment and has a large compatibility surface - Easy to hit limits of declarative dependency files, being forced into implementing them in Python (see above) - Project templates are hard coded.

pfultz2 9y ago

Actually cget can install packages directly from cmake packages(or other build systems). There is also the cmake-get module which can install cget recipes directly in the cmake without needing cget or python installed.