3 ms·

> Python has notoriously terrible dependency management. It's a pretty low bar. That's subjective. In my mind it's the only one that makes any sort of sense an

> Python has notoriously terrible dependency management. It's a pretty low bar. That's subjective. In my mind it's the only one that makes any sort of sense and isn't a freaking nightmare to use.

michaelt 3y ago
Some would say the fact that venvs and conda are so widely used shows that many users encounter problems with the stock Python dependency management.
- TrickardRixx 3y ago
  Are venvs not part of stock Python dependency management?
- rcxdude 3y ago
  conda is now primarily a way to fuck up a python environment, at least in the hands of most useres.
  - lmm 3y ago
    The same is equally true of almost every python dependency management tool.
josephg 3y ago
As a software developer who’s written a fair bit of code in JavaScript, C and recently Rust, the idea that I would look for my dependencies in apt on Debian is a bad joke. At best I’ll get some ancient version of the things I depend on. But more likely, 2/3rds of the libraries I use simply won’t be there at all. Is the rust compiler in apt? Is serde? Rand? What about the long tail of my programs dependencies? I remember looking in apt for nodejs one time and the version it had was about 5 years out of date, and it was missing all sorts of quality of life features that I had long since taken for granted (like promises). And of course, half of the packages in npm failed to run at all as a result. It was a complete non starter. Maybe I should have searched apt for ancient versions of common JavaScript libraries from a similar vintage? Then I could install them system wide. Yay. And what would all that extra hassle get me? A JavaScript program that would only work on one crusty Linux distribution. Which is strictly worse than what nodejs ships with out of the box: npm. Up to date packages. Modern JavaScript. And compatibility a mile wide. And I could tell the same story with rust and cargo, and plenty of other languages. Apt really makes no sense at all to use in this context. Maybe it’s fine to install X and gvim. But that’s about it. If Debian really wants to mirror npm and cargo and other languages’ package managers, why don’t they just automate it, and add the hundreds of thousands of packages en masse? Manually adding specific versions of packages from npm and cargo sounds like a massive waste of human effort. At best it will only ever produce a pale imitation of the real package repositories. I just don’t see the point.
- yjftsjthsd-h 3y ago
  The idea of Debian is to have a stable system that doesn't change if it possibly can for the life of the release. If you want to constantly get new breaking changes in your packages, switch to testing or sid.
  - curt15 3y ago
    What if I want to develop applications using the latest dependency versions on a stable system? Are flatpak/docker/podman the recommended solutions?
    - tremon 3y ago
      If you want the latest dependencies, you don't have a stable system: it shifts with the versions of your dependencies. In Debian, you would use an unstable/sid chroot with the new versions (see debootstrap).
      - josephg 3y ago
        That’s a weird usage of the term “stable”. Is the latest rustc release unstable? Are there bugs in nodejs? It’s been years since a nodejs bug affected me. If anything you usually have fewer problems with newer toolchains, because new features get used by your dependencies. The version of rustc or nodejs that Debian considers “stable” won’t be able to run a lot of software that I want to run. And despite the name, “unstable” Debian is still usually 6 months behind the latest version of most packages. That’s an eternity for new things like Zig.
        tremon 3y ago
        It's the Debian usage of the term "stable". Seems kinda relevant for the discussion, at least to me. From https://wiki.debian.org/DebianStability https://wiki.debian.org/DebianStability: This is what Debian's Stable name means: that, once released, the operating system remains relatively unchanging over time. > That’s an eternity for new things like Zig So why isn't Zig making sure that their latest releases are available in Debian Sid? Anyone can be a Debian Maintainer, and if they don't want to invest their time in it, they just need an existing DM to sponsor their uploads.

> Python has notoriously terrible dependency management. It's a pretty low bar. That's subjective. In my mind it's the only one that makes any sort of sense and isn't a freaking nightmare to use.

michaelt 3y ago

Some would say the fact that venvs and conda are so widely used shows that many users encounter problems with the stock Python dependency management.

TrickardRixx 3y ago
Are venvs not part of stock Python dependency management?
rcxdude 3y ago
conda is now primarily a way to fuck up a python environment, at least in the hands of most useres.
- lmm 3y ago
  The same is equally true of almost every python dependency management tool.

josephg 3y ago

As a software developer who’s written a fair bit of code in JavaScript, C and recently Rust, the idea that I would look for my dependencies in apt on Debian is a bad joke. At best I’ll get some ancient version of the things I depend on. But more likely, 2/3rds of the libraries I use simply won’t be there at all. Is the rust compiler in apt? Is serde? Rand? What about the long tail of my programs dependencies? I remember looking in apt for nodejs one time and the version it had was about 5 years out of date, and it was missing all sorts of quality of life features that I had long since taken for granted (like promises). And of course, half of the packages in npm failed to run at all as a result. It was a complete non starter. Maybe I should have searched apt for ancient versions of common JavaScript libraries from a similar vintage? Then I could install them system wide. Yay. And what would all that extra hassle get me? A JavaScript program that would only work on one crusty Linux distribution. Which is strictly worse than what nodejs ships with out of the box: npm. Up to date packages. Modern JavaScript. And compatibility a mile wide. And I could tell the same story with rust and cargo, and plenty of other languages. Apt really makes no sense at all to use in this context. Maybe it’s fine to install X and gvim. But that’s about it. If Debian really wants to mirror npm and cargo and other languages’ package managers, why don’t they just automate it, and add the hundreds of thousands of packages en masse? Manually adding specific versions of packages from npm and cargo sounds like a massive waste of human effort. At best it will only ever produce a pale imitation of the real package repositories. I just don’t see the point.

yjftsjthsd-h 3y ago
The idea of Debian is to have a stable system that doesn't change if it possibly can for the life of the release. If you want to constantly get new breaking changes in your packages, switch to testing or sid.
- curt15 3y ago
  What if I want to develop applications using the latest dependency versions on a stable system? Are flatpak/docker/podman the recommended solutions?
  - tremon 3y ago
    If you want the latest dependencies, you don't have a stable system: it shifts with the versions of your dependencies. In Debian, you would use an unstable/sid chroot with the new versions (see debootstrap).
    - josephg 3y ago
      That’s a weird usage of the term “stable”. Is the latest rustc release unstable? Are there bugs in nodejs? It’s been years since a nodejs bug affected me. If anything you usually have fewer problems with newer toolchains, because new features get used by your dependencies. The version of rustc or nodejs that Debian considers “stable” won’t be able to run a lot of software that I want to run. And despite the name, “unstable” Debian is still usually 6 months behind the latest version of most packages. That’s an eternity for new things like Zig.
      - tremon 3y ago
        It's the Debian usage of the term "stable". Seems kinda relevant for the discussion, at least to me. From https://wiki.debian.org/DebianStability https://wiki.debian.org/DebianStability: This is what Debian's Stable name means: that, once released, the operating system remains relatively unchanging over time. > That’s an eternity for new things like Zig So why isn't Zig making sure that their latest releases are available in Debian Sid? Anyone can be a Debian Maintainer, and if they don't want to invest their time in it, they just need an existing DM to sponsor their uploads.