Re: Reconsider defaults for use-package-vc-prefer-newest

[Tony Zorman <tonyzorman@mailbox.org>]

On Thu, Sep 19 2024 11:49, Philip Kaludercic wrote:
> "Martin Edström" <meedstrom@runbox.eu> writes:
>
>> Previous discussion: https://debbugs.gnu.org/cgi/bugreport.cgi?bug=67955
>>
>> Currently, the setting of `use-package-vc-prefer-newest` defaults to nil.
>> I want to bring up some problems with that, and suggest fixes.
>
> Sorry for the late response, I'm responsible for this decision and would
> like to defend it here.  Feel free to CC me in future discussions
> pertaining to package-vc.  I have also added Tony to the CCs, as he has
> a better understanding of the use-package side of this.

Thanks!

>> PROBLEM 1. MISMATCH WITH PACKAGE-VC
>>
>> Now use-package :vc is not in line with the behavior of the
>> package-vc-install command, which fetches the newest commit.
>>
>> All other package managers I know of also fetch the newest commit.
>
> The main reference is package.el, which by default uses GNU ELPA and
> NonGNU ELPA.  Both distribute explicitly released packages, as indicated
> by the version header.  To me this has a much greater weight than what
> third-party package managers and archives decide to do.

I will say that I also find it surprising behaviour that, by default,

    (package-vc-install "«URL»")

and

    (use-package blah
      :vc (:url "«URL»"))

have different semantics.

Ultimately, different people have different preferences and needs—for
example, "distros" such as DOOM Emacs manually pin all of their packages
to specific commits in order to ensure coherence. As you already know, I
personally would be in favour of setting use-package-vc-prefer-newest to
t by default, but I also only install packages that are either not on a
package archive or that I plan to contribute to with package-vc.el, the
rest is managed by my operating system.

>> It is the new use-package :vc which is the odd one out in the
>> ecosystem, and that can cause stability issues, which I go into
>> more deeply on this Reddit comment:
>>
>> https://old.reddit.com/r/emacs/comments/1f8ok7c/do_you_set_packageinstallupgradebuiltin_to_t/llimwe0/
>
>>
>> PROBLEM 2. "LAST RELEASE" CANNOT BE ASSUMED TO BE THE LAST RELEASE
>>
>> I see many packages that have not bumped their Package-Version
>> header for years.  Perhaps they bump by git tags, or just stopped
>> bumping versions.  I understand them, since it is a lot of manual
>> labor to bump it, cut a release commit, then bump again to append a
>> "-pre" or a ".0.50-git", and to remember to do this everywhere the
>> version string may occur, like in docs.
>>
>> I'm also guessing there's a segment of developers that have sensed
>> that this labor does not end up helping users, so they are not
>> motivated to keep doing it.  Versions only work as intended if
>> everyone is versioning regularly, and that is possible to enforce
>> in a curated repo like GNU Elpa or Debian's repackaged Emacs
>> packages, but as soon as you also install packages outside of that
>> repo (and well, most packages are outside), there's no longer any
>> guarantee and in fact the outdated versions in the curated repo are
>> likely to cause breakage.
>>
>> I have personally had to give up on things like ELPA, Melpa Stable,
>> Debian packages etc.  It always caused instability.  By contrast,
>> installing 200-400 packages off Melpa, in other words the latest
>> dev snapshots, has caused me no issues in ~7 years.  So there are
>> two islands of stability:
>>
>> 1. Stay inside a curated repo entirely
>> 2. Leave the curated repo entirely and install only dev snapshots
>>
>> Now consider what use-package :vc is for.  It is for installing
>> things OUTSIDE any curated repo.  I leave it to you to pick a
>> default setting for `use-package-vc-prefer-newest`.
>
> No, this is an unjustified assumption.  FWIW my intention of writing
> package-vc was to make contributing to packages easier.  The reason the
> "install latest release" option exists for package-vc is that it can
> make it easier to fix a bug with the current version.
>
> The thing is that with use-package, having a more deterministic
> installation is of interest, especially since use-package is used to
> automatically set up an Emacs environment.

I feel like the only way to actually guarantee a deterministic
installation procedure is to use outside means (that is, to ping
packages to specific versions/commits, either manually or with nix
et.al). This can certainly be done with package-vc.el as well, but
that's not what happens when one just uses :last-release.

  Tony

-- 
Tony Zorman | https://tony-zorman.com