Existing Package Management Systems*

Relevant Related Work The Deliver Project, head by P. Kint at CWI, is a very interesting related work, not focused on Open Source, but tackling problems similar to ours: for example, they use FeatureDiagrams to model dependencies and configurations, and BDD algorithms to perform automated checking of model properties. See for example the paper Variability and Component Composition. Another paper is Feature Based product line instantiation.

Analyses of repositories of packages

Inter-Package Dependency Networks in Open-Source Software This research analyzes complex networks in open-source software at the inter-package level, where package dependencies often span across projects and between development groups. We review complex networks identified at ``lower'' levels of abstraction, and then formulate a description of interacting software components at the package level, a relatively ``high'' level of abstraction. By mining open-source software repositories from two sources, we empirically show that the coupling of modules at this granularity creates a small-world and scale-free network in both instances. http://arxiv.org/abs/cs/0411096

Experiments with existing tools

2003, a nice report on LWN

a comparison of binary package formats

Ideas on packaging

• • using ldd on package binaries to ascertain real dependencies

From comments to http://linuxworld.com/story/38081.htm More important than a standard package management / dependency resolution system is a standard for what package names to use, and what files they should contain. Debian has the lead here, simply because the RPM-based distributions have fragmented their choices to some extent. However, I agree that urpmi is superior in some respects to apt-get.

However, in my view, it would be better yet if we could stop relying on the package to contain dependency information, and instead extract it from the files themselves. That is, use ldd against all executables in a package to determine which libraries are needed, at install time. If the libraries are already in the system (no matter how they got there), the install proceeds, otherwise, a search for packages providing those libraries is made, both on local CDs and over the network (like urpmi can do). The information retrieved should be cached, to speed up future installs, and the CDs could already contain a local cache. The difference here is the cache would be dynamically built from the actual contents of the package, not from what the package creator "said" was in the package. Also, it wouldn't matter if your libraries were installed via RPM, apt, or simply extracting a .tgz file.

• • a framework to get new version straight form the sources (Luau) :

http://luau.sourceforge.net/luau-whitepaper.pdf

• • see also Autodist
  • SCRAM (Software Configuration, Release And Management) is worth a look.

• works with source-code repositories (supporting CVS)
• allows point-to-click installation (from a web page)
• bootstrap document containing server's urls
• separate "requirement document" which is then shareable between projects ; also this document can be displayed as a web page (XML syntax)

• • GNU Source Installer is based on the GNU philosophy configure && make && make install.
  • Zero Install Dependency Injector resolves dependencies and installs as non-root user
  • About computing dependencies without relying on the packages' meta-data and other hard problems

While we are at it, with the wp4 infrastructure, we can consider some grid computing strategy, caching, indexing and incremented searches.

• A distribution shape does not change often
• Additional packages or modified packages may not need to recompute everything
• Results can be cached and indexed in the P2P system
• many users can join computing forces in their best interest
• a state of a user machine can be computed at install time and cached as well

How hard can be a problem with an exponentially growing(*) user-base? (*) or so we hope ;-)

Add to this some AI to optimize package definitions and P2P network...

Existing Package Management Systems*

• Debian Apt
• Urpmi
• Gentoo Portage
• Smart (developped by Conectiva)

{metadata}

Topics Wp2

{metadata}