Re: What about dependency resolution à la apt?

[Chris Marusich <cmmarusich@gmail.com>]

[-- Attachment #1: Type: text/plain, Size: 2149 bytes --]

ludo@gnu.org (Ludovic Courtès) writes:

> Howdy Amirouche!
>
> Amirouche <amirouche@hypermove.net> skribis:
>
>> Le 16/03/2017 à 21:28, Tobias Geerinckx-Rice a écrit :
>>> Amirouche,
>>>
>>> On 16/03/17 19:52, Amirouche wrote:
>>>> Héllo,
>>> Hi!
>>>
>>> I'm not the most technically qualified person to answer this, nor the
>>> most articulate, but I'm mainly curious and slightly puzzled as to why
>>> this question keeps popping up.
>>
>> Sorry!
>
> No problem, there’s nothing wrong with your question.
>
> The key point in Tobias’ message is this:
>
>>> But one of the many great things about functional package management à
>>> la Nix/Guix is that you don't need — or want — a dependency resolver. At
>>> all. That eliminates a lot of nasty problems, and makes others much
>>> easier to solve.
>
> Tools like apt allow developers to describe a (very large) set of
> possible dependency graphs, which the dependency resolver tries hard to
> narrow down to something reasonable.
>
> Conversely, functional package managers describe just one dependency
> graph.  The downside is the “security update” scenario, though we
> address it with grafts¹, and the huge advantage is that we get tractable
> build processes and package composition.
>
> HTH!
>
> Ludo’.
>
> ¹ https://gnu.org/s/guix/news/timely-delivery-of-security-updates.html

Amirouche, your question is a perfectly natural one to ask.  If you're
hungry for additional information regarding this interesting topic,
consider reading the introduction to Eelco Dolstra's Nix thesis [1].  In
the first 17 pages, he describes the main issues in the field of
software deployment, surveys the state of the art (as of August 2006)
while pointing out the unsolved problems, and summarizes how Nix (and
thus Guix, which uses Nix) solves those problems.

Section 1.2 is of particular interest.  In it, Eelco explains why the
practice of specifying dependencies by name (even when a version is
included) is insufficient for correct deployment of software.

[1] https://nixos.org/%7Eeelco/pubs/phd-thesis.pdf

-- 
Chris

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 832 bytes --]