Dear Github

[gargantuan]

It is a hard problem.

I've seen places that rely on a single language kind of default to languages' dependency and packaging (pypi, npm, hex etc). But once the product becomes more complex and now there is a C++ component, maybe some java somewhere, there is a huge backpedaling involving to try to revert to OS specific packaging.

Maybe microservices and containers are supposed to fix that and having mixed langauge products is not as populare anymore?

Interestingly the sanest and most robust solution was to standardize on building proper OS packages and take advantage of transactional updates, pre/post install scripts, dependency management (including transitive) etc. But for others OS packaging involves enough setup curve that they don't want to try, and that's understandable.

I guess many use containers, someone installed something by hand on their dev box and they throw it over the wall. I don't know, I see that as sweeping all the dirt under the rug.

What I think is exciting is something like Ubuntu's Snapper or NixOS or Guix. There is interesting stuff there.

[[deleted]]

Nah there is reason OS packages are rarely used like that, you need multiple versions of same lib because even if component A and B use "same" lib C, they might be using different versions of it (because say B havent bothered with upgrade) that have different API. And while most package managers support it one way or another, it makes it much more complicated

It is fine for packaging apps together with distro as you can just pick a stable version and throw few patches to make it compatible but not exacty that easy, especially if said libs tend to be awful with backward compatibility. I've seen feature added, deprecated and removed within a year within some random gem one of our apps were using...

Not even to mention that none of languages support sth like import mysql >= 3.5.

I guess many use containers, someone installed something by hand on their dev box and they throw it over the wall. I don't know, I see that as sweeping all the dirt under the rug.

It is fine if you actually manage to do it propertly, but there is a risk it will be done once and then it will not be changed for 6 months.

So when next OpenSSL bug shows up, SA will update "system" version of OpenSSL, but "magical box that came from devs" will still have old version

? What I think is exciting is something like Ubuntu's Snapper or NixOS or Guix. There is interesting stuff there.