8 ms·

C Package Manager

142 points by synergy20 5y ago

blondin 5y ago
is the website up to date? it seems to be missing a package that has a repo in their org.
ampdepolymerase 5y ago
The best C and C++ package manager I have used is Xmake/Xrepo. They support all the major package repositories out of the box including Vcpkg and Conan. https://github.com/xmake-io/xmake#supported-package-repositories https://github.com/xmake-io/xmake#supported-package-reposito...
- synergy20 5y ago
  xmake is a great tool with complexity. clib's key design goal is simplicity, use the best fit one for next project.
  - waruqi 5y ago
    xmake also support clib, https://xmake.io/#/package/remote_package?id=add-clib-dependency-package https://xmake.io/#/package/remote_package?id=add-clib-depend...
  - sanxiyn 5y ago
    Simplicity is vastly overrated.
    - szundi 5y ago
      This. Simplicity should not be confused with lack of necessary features for bigger projects that hopefully yours will be.
    - burrows 5y ago
      X is vastly overrated.
pipeline_peak 5y ago
Great idea, but might want to change the name to avoid confusion with libc. Unless that was some sort of play on words, idk
throwamon 5y ago
The best C and [insert any language here] package manager is Nix. Or rather, it should be[1]. I'm fairly confident something like it will be. If you haven't, please do try it out (or maybe don't[1], but at least read the paper[2] and let its ideas sink in). I honestly just sigh and think "yet another package manager and they still haven't learned..." whenever I see a new one now. [1]: Unfortunately documentation is famously bad, the repo that holds package declarations is full of undocumented conventions, there often isn't a "blessed" way of doing things, and there are some other warts, such as all the difficulty one may experience from having to learn a new functional, lazy, dynamically typed language. I'm not aware of active, coordinated efforts to improve on these fronts, except for new languages such as Nickel. [2]: https://edolstra.github.io/pubs/phd-thesis.pdf https://edolstra.github.io/pubs/phd-thesis.pdf (don't be discouraged by the number of pages, it's fine if you read just the first part)
- pjmlp 5y ago
  Assuming GNU/Linux is the only thing C developers care about.
  - tadfisher 5y ago
    Nix also runs on Darwin and BSD.
    - pjmlp 5y ago
      Ok a bit better, doesn't change the fact it doesn't run everywhere where there is a C compiler.
      - _k9eq 5y ago
        Not everyone using C is writing software that turns on all platforms supported by any C compiler?
        pjmlp 5y ago
        Not everyone using C cares about UNIX FOSS clones.
Fiahil 5y ago
Inspired by Cargo?
coffeebeanHH 5y ago
> ...all of them under different licenses, carrying different code standards...This issue needed to be fixed. [1] Ehrm I don't see how that issue should be solved. I gave it a first look and there's clearly no way of filtering by license. Most of the sources in deps are MIT license but there are also BSD. So after you copy all the libs together you have to go through the package.json to find all the different licenses and if obliged copy them into your archive. Same can hold for the code from various sources. I don't think they all follow the same standard (It's an assumption. I didn't bother checking it.). [1] The Advent of Clib - https://web.archive.org/web/20200128184218/http://blog.ashworth.in/2014/10/19/the-advent-of-clib-the-c-package-manager.html https://web.archive.org/web/20200128184218/http://blog.ashwo...
xucheng 5y ago
> The wiki listing of packages acts as the "registry" and populates the clib-search(1) results. This seems to be an extremely bad idea. Since everyone can edit the GitHub wiki pages, it means its registry is vulnerable to all kinds of malicious attack.
- Sander_Marechal 5y ago
  Many more things about thsi seem a bad idea. They're proudly making all of npm's mistakes all over again.
  - moralestapia 5y ago
    And it's soooo gooood that they're doing it! The C ecosystem desperately needs an npm, it's actually coming in 10 years too late. I don't mind the naysaying. Yeah sure, "you could have done it better", but then you didn't so this is better than none. I'll take real things over illusions any day :D!
kardos 5y ago
Anaconda is a bit of a dark horse here as a C package manager. Eg, in scenarios where you don't have root, or working on windows.
- burntoutfire 5y ago
  Anaconda, with it's "solving package specifications" frequently taking many minutes or hours, is barely usable.
quietbritishjim 5y ago
vcpkg [1] is also a workable C package manager. It mainly has C++ packages but does include a few C packages e.g. glib [2]. In addition, you can use it on a separate list of package recipes (portfiles as vcpkg calls them), in case you want to use packages not in the central repo. It's based on CMake and runs on Windows and Linux (and other platforms I think but I haven't tried). [1] https://vcpkg.io/ https://vcpkg.io/ [2] https://github.com/microsoft/vcpkg/tree/master/ports/glib https://github.com/microsoft/vcpkg/tree/master/ports/glib
- andrewmcwatters 5y ago
  I immediately disqualified this as a viable package manager after I found its distributions were modified from the original sources in some cases. That’s just unacceptable. It is otherwise so very close…
otikik 5y ago
> promoting smaller C utilities Ok but not too small. No one wants a left-pad.c
- Saint_Genet 5y ago
  I give you https://github.com/vendethiel/strlen.c https://github.com/vendethiel/strlen.c
  - _wolfie_ 5y ago
    Great, it's on version 0.0.1. It's hard to get stable API right on the first try for projects of this magnitude, so I think it's great they keep the room for adjustments before going to 1.0. /s
guavaNinja 5y ago
If a project supports cmake, this is the best package manager to fetch it https://github.com/cpm-cmake/CPM.cmake https://github.com/cpm-cmake/CPM.cmake
TruthWillHurt 5y ago
This is amazing. Coming from Python and Node, this makes C so much more usable to me!
ncake 5y ago
I use CMake's FetchContent. It's probably the most universal solution for this out there.
belter 5y ago
At least the five items below should probably have an answer upfront before embarking on the creation of package manager. Particularly one intended for general widespread use: - How do plan to address the issues of trust, security, auditing, copyright and licensing, trough the life-cycle of the artifacts in your registry. - How do you plan to enforce the artifacts integrity both registry side as well as client side while using unreliable hardware. - How do you plan to manage your dependencies and limit the blast radius of unforeseen events. - Do you have a community model for namespace management. - Do you have a model to implement Two or Three Person/Group rule for critical changes? Edit: this latest is usually called the Two-Man Rule...
mark_l_watson 5y ago
This looks nice, something I would have really appreciated way back when I used to use C and C++. In the 1980s, my “package management” was a huge collection of file lists with descriptions for public FTP sites, grab relevant source code as needed… I like the side conversation here about Nix. I have not tried Nix in its own, but when I used to use non-M1 Macs, I had NixOS running in VirtualBox. I may be wrong about this, but I love the huge variety in programming languages, operating systems, package managers, development tools, etc. A world with a tech monoculture would be boring.
myko 5y ago
I keep hoping Swift Package Manager will fill this void.
bogwog 5y ago
I’m surprised there’s no mention of Conan yet in this thread. Conan IMO is the dependency management solution for C and C++. Nix/Guix are nice, but they’re much heavier than Conan.
- beached_whale 5y ago
  vcpkg is quite good too. The manifest mode works really well and lets one succinctly describe their products dependencies.
  - pjmlp 5y ago
    vcpkg is great.
canbus 5y ago
Another one.

142 points by synergy20 5y ago

is the website up to date? it seems to be missing a package that has a repo in their org.

The best C and C++ package manager I have used is Xmake/Xrepo. They support all the major package repositories out of the box including Vcpkg and Conan. https://github.com/xmake-io/xmake#supported-package-repositories https://github.com/xmake-io/xmake#supported-package-reposito...

synergy20 5y ago
xmake is a great tool with complexity. clib's key design goal is simplicity, use the best fit one for next project.
- waruqi 5y ago
  xmake also support clib, https://xmake.io/#/package/remote_package?id=add-clib-dependency-package https://xmake.io/#/package/remote_package?id=add-clib-depend...
- sanxiyn 5y ago
  Simplicity is vastly overrated.
  - szundi 5y ago
    This. Simplicity should not be confused with lack of necessary features for bigger projects that hopefully yours will be.
  - burrows 5y ago
    X is vastly overrated.

pipeline_peak 5y ago

Great idea, but might want to change the name to avoid confusion with libc. Unless that was some sort of play on words, idk

throwamon 5y ago

The best C and [insert any language here] package manager is Nix. Or rather, it should be[1]. I'm fairly confident something like it will be. If you haven't, please do try it out (or maybe don't[1], but at least read the paper[2] and let its ideas sink in). I honestly just sigh and think "yet another package manager and they still haven't learned..." whenever I see a new one now. [1]: Unfortunately documentation is famously bad, the repo that holds package declarations is full of undocumented conventions, there often isn't a "blessed" way of doing things, and there are some other warts, such as all the difficulty one may experience from having to learn a new functional, lazy, dynamically typed language. I'm not aware of active, coordinated efforts to improve on these fronts, except for new languages such as Nickel. [2]: https://edolstra.github.io/pubs/phd-thesis.pdf https://edolstra.github.io/pubs/phd-thesis.pdf (don't be discouraged by the number of pages, it's fine if you read just the first part)

pjmlp 5y ago
Assuming GNU/Linux is the only thing C developers care about.
- tadfisher 5y ago
  Nix also runs on Darwin and BSD.
  - pjmlp 5y ago
    Ok a bit better, doesn't change the fact it doesn't run everywhere where there is a C compiler.
    - _k9eq 5y ago
      Not everyone using C is writing software that turns on all platforms supported by any C compiler?
      - pjmlp 5y ago
        Not everyone using C cares about UNIX FOSS clones.

Fiahil 5y ago

Inspired by Cargo?

coffeebeanHH 5y ago

> ...all of them under different licenses, carrying different code standards...This issue needed to be fixed. [1] Ehrm I don't see how that issue should be solved. I gave it a first look and there's clearly no way of filtering by license. Most of the sources in deps are MIT license but there are also BSD. So after you copy all the libs together you have to go through the package.json to find all the different licenses and if obliged copy them into your archive. Same can hold for the code from various sources. I don't think they all follow the same standard (It's an assumption. I didn't bother checking it.). [1] The Advent of Clib - https://web.archive.org/web/20200128184218/http://blog.ashworth.in/2014/10/19/the-advent-of-clib-the-c-package-manager.html https://web.archive.org/web/20200128184218/http://blog.ashwo...

xucheng 5y ago

> The wiki listing of packages acts as the "registry" and populates the clib-search(1) results. This seems to be an extremely bad idea. Since everyone can edit the GitHub wiki pages, it means its registry is vulnerable to all kinds of malicious attack.

Sander_Marechal 5y ago
Many more things about thsi seem a bad idea. They're proudly making all of npm's mistakes all over again.
- moralestapia 5y ago
  And it's soooo gooood that they're doing it! The C ecosystem desperately needs an npm, it's actually coming in 10 years too late. I don't mind the naysaying. Yeah sure, "you could have done it better", but then you didn't so this is better than none. I'll take real things over illusions any day :D!

kardos 5y ago

Anaconda is a bit of a dark horse here as a C package manager. Eg, in scenarios where you don't have root, or working on windows.

burntoutfire 5y ago
Anaconda, with it's "solving package specifications" frequently taking many minutes or hours, is barely usable.

quietbritishjim 5y ago

vcpkg [1] is also a workable C package manager. It mainly has C++ packages but does include a few C packages e.g. glib [2]. In addition, you can use it on a separate list of package recipes (portfiles as vcpkg calls them), in case you want to use packages not in the central repo. It's based on CMake and runs on Windows and Linux (and other platforms I think but I haven't tried). [1] https://vcpkg.io/ https://vcpkg.io/ [2] https://github.com/microsoft/vcpkg/tree/master/ports/glib https://github.com/microsoft/vcpkg/tree/master/ports/glib

andrewmcwatters 5y ago
I immediately disqualified this as a viable package manager after I found its distributions were modified from the original sources in some cases. That’s just unacceptable. It is otherwise so very close…

otikik 5y ago

> promoting smaller C utilities Ok but not too small. No one wants a left-pad.c

Saint_Genet 5y ago
I give you https://github.com/vendethiel/strlen.c https://github.com/vendethiel/strlen.c
- _wolfie_ 5y ago
  Great, it's on version 0.0.1. It's hard to get stable API right on the first try for projects of this magnitude, so I think it's great they keep the room for adjustments before going to 1.0. /s

guavaNinja 5y ago

If a project supports cmake, this is the best package manager to fetch it https://github.com/cpm-cmake/CPM.cmake https://github.com/cpm-cmake/CPM.cmake

TruthWillHurt 5y ago

This is amazing. Coming from Python and Node, this makes C so much more usable to me!

ncake 5y ago

I use CMake's FetchContent. It's probably the most universal solution for this out there.

belter 5y ago

At least the five items below should probably have an answer upfront before embarking on the creation of package manager. Particularly one intended for general widespread use: - How do plan to address the issues of trust, security, auditing, copyright and licensing, trough the life-cycle of the artifacts in your registry. - How do you plan to enforce the artifacts integrity both registry side as well as client side while using unreliable hardware. - How do you plan to manage your dependencies and limit the blast radius of unforeseen events. - Do you have a community model for namespace management. - Do you have a model to implement Two or Three Person/Group rule for critical changes? Edit: this latest is usually called the Two-Man Rule...

mark_l_watson 5y ago

This looks nice, something I would have really appreciated way back when I used to use C and C++. In the 1980s, my “package management” was a huge collection of file lists with descriptions for public FTP sites, grab relevant source code as needed… I like the side conversation here about Nix. I have not tried Nix in its own, but when I used to use non-M1 Macs, I had NixOS running in VirtualBox. I may be wrong about this, but I love the huge variety in programming languages, operating systems, package managers, development tools, etc. A world with a tech monoculture would be boring.

myko 5y ago

I keep hoping Swift Package Manager will fill this void.

bogwog 5y ago

I’m surprised there’s no mention of Conan yet in this thread. Conan IMO is the dependency management solution for C and C++. Nix/Guix are nice, but they’re much heavier than Conan.

beached_whale 5y ago
vcpkg is quite good too. The manifest mode works really well and lets one succinctly describe their products dependencies.
- pjmlp 5y ago
  vcpkg is great.

canbus 5y ago

Another one.