Observations on Software Package Managers

It’s interesting to watch the landscape of software development evolve over time.

One of those evolution's is the advent of package managers. As an application developer, having access to a global library of code packages which can be pulled down in an automated way, is such a valuable addition to the development experience.

They are everywhere! For example:

Package managers are here and they definitely increase productivity by making common code easier to include in your project.

When I first uploaded my projects to Github, I mistakenly included all my third party Nuget packages and forgot that one of the other jobs of a package manager is to install/restore missing packages when required.

Beautiful… That, is of course, until it goes wrong…

For example, if you don’t pin a specific version of a library, there is nothing to stop the owner of that third party library from making breaking changes to your code. This means you will not be able to successfully build your project in the future.

For example, in JavaScript with NPM, if you just list all your dependencies (in the package.json file) without specific versions, this will pull down the latest version(s) automatically.

So pinning to a specific version is good practice.

But, on the flip-side, recently I was trying to download a C# project from GitHub that required a Nuget restore. The problem was, the version that the C# project relied on didn't exist in Nuget! Nuget failed to retrieve the version that was pinned. This meant I couldn't build the code.

However, even with these subtle observations/gotcha’s aside, package managers are a great addition to the software developer’s toolkit.

If you are a C# developer and use Nuget you might want to check out the NuGet.CommandLine package by running "Install-Package NuGet.CommandLine". Instructions are here. This can be handy for automated builds and will enable you to run commands like "nuget delete", "nuget restore" and "nuget update"

Now, I would love to see a C++ package manager but it doesn’t look like there is one yet. Maybe thats because it still uses #includes and doesn't have the concept of a package! - Maybe when modules make it into the language there will be some hope there. I don't know if it’s out of scope for the guys over as https://isocpp.org/ but it would be good if there was an official one!

One can hope…

By the way, this website https://libraries.io/ monitors "open source libraries across 32 different package managers", which could be a great way to search for new libraries to include in software projects.


Comments

Post a Comment

Popular posts from this blog

SeriLog & Application Diagnostic Logging

Image
Show me an application that doesn't log anything and i'll show you an application which is hard to debug. Every application we write should have a healthy sprinkling of diagnostic logging embedded throughout its logic. A trace to show us what's happening on the inside from the outside. In the past, I've hand-rolled my own bespoke logging classes to output either to file, database or simply console. Not any more! The problem has been solved. It's been done. There are libraries out there like Log4Net or Nlog But from now on, I intend to standardise all my C# code to use SeriLog . SeriLog is an example of a library where so many developers have poured in so much time that any home grown library cannot compete. Why waste your time? Just "nuget" it into your project and be done. Move on. Why is it so cool? Because it's simple. And because it supports many, many outputs. They call them sinks and there is a sink for everything as you ca
Read more

OxyPlot Charting Control

Image
The other day, I needed to display a simple time-series chart inside a little tool I was writing. Now, as we know the web has a slew of cool charting controls to pick from including chart.js and amcharts.js which I have used in the past and are great. But those libraries were out of the question because I needed to include the chart inside a WinForms application. Now, in the past I played with the Charting Controls from Microsoft and whilst they are good, that suite of controls has not been updated for an ice-age! So I decided to have a look to see what the landscape looks like for charting controls in the WinForms / WPF arena which is where I came across OxyPlot . OxyPlot is a cross-platform library for .NET and supports WinForms, WPF, Xamarin and UWP (but let's be honest, Who is targeting universal windows apps?). What makes OxyPlot interesting is that their main page says the project is supported by the likes of JetBrains and Xamarin to mention just a few! Thos
Read more

Android, Self-Signed Certificates and OkHttp

Image
Just recently I have been writing a private Android application using the latest freshness that is Kotlin . Of course, like all mobile applications, it makes heavy use of HTTP requests, sending data back and forth between my app and the back-end API. Because this app is private, it will never be released in the Google Play store and the back-end server will not be publicly available on the internet. The server is a private home web server on an internal network (think intranet) and the application will only contact it over my home WiFi. Did you know that Sensitive Data Exposure is still on the 2017 OSWASP top 10 list ? It's currently sitting at the #3 spot. The OSWASP folks say: "Over the last few years, this has been the most common impactful attack. The most common flaw is simply not encrypting sensitive data." So, as a good developer, my next job was to switch my project to use HTTPS/TLS . That's when I remembered Let’s Encrypt which is a free , auto
Read more