7 ms·

Debian is somehow able to manage it for apt.

• firesteelrain 10mo ago
  1. Debian is local first via client side cache 2. apt repositories are cryptographically signed, centrally controlled, and legally accountable. 3. apt search is understood to be approximate, distro-scoped, and slow-moving. Results change slowly and rarely break scripts. PyPI search rankings change frequently by necessity 4. Turning PyPI search into an apt-like experience would require distributing a signed, periodically refreshed global metadata corpus to every client. At PyPI’s scale, that is nontrivial in bandwidth, storage, and governance terms 5. apt search works because the repository is curated, finite, and opinionated
  • froh 10mo ago
    isn't this an incrementally updatable tree that is managed with a Merkle tree? git-like, essentially?
    • firesteelrain 10mo ago
      The install side is basically Merkle-friendly (immutable artifacts, append-only metadata, hashes, mirrors). Search isn’t. Search results are derived, subjective, and frequently rewritten (ranking tweaks, spam/malware takedowns, popularity signals). That’s more like constantly rebasing than appending commits. You can Merklize “what files exist”; you can’t realistically Merklize “what should rank for this query today” without freezing semantics and turning CLI search into a hard API contract.
      • froh 10mo ago
        are you saying PyPi search is spammed o-O ?
        • firesteelrain 10mo ago
          Yes, it was subject to abuse so they had to shutdown the XML-RPC API