<story><title>Writing a Package Manager</title><url>https://antonz.org/writing-package-manager/</url></story><parent_chain><item><author>brabel</author><text>The author added a lockfile without understanding why they exist.&lt;p&gt;A lockfile is meant to &amp;quot;freeze&amp;quot; dependency version resolution when package authors can specify dependencies on other packages using version ranges... it also &amp;quot;freezes&amp;quot; choices of transitive packages&amp;#x27; versions when different packages depend on the same one, but with different versions.&lt;p&gt;They chose to not handle package dependencies at all, and I believe there&amp;#x27;s no version ranges either, so I really don&amp;#x27;t see why they added a lockfile.</text></item></parent_chain><comment><author>nalgeon</author><text>There is quite a difference between &amp;quot;the author added a lockfile without understanding why they exist&amp;quot; and &amp;quot;I really don&amp;#x27;t see why they added a lockfile&amp;quot;.&lt;p&gt;It&amp;#x27;s better to start with the latter if you seek to understand, not attack.</text></comment>
<story><title>Writing a Package Manager</title><url>https://antonz.org/writing-package-manager/</url></story><parent_chain><item><author>brabel</author><text>The author added a lockfile without understanding why they exist.&lt;p&gt;A lockfile is meant to &amp;quot;freeze&amp;quot; dependency version resolution when package authors can specify dependencies on other packages using version ranges... it also &amp;quot;freezes&amp;quot; choices of transitive packages&amp;#x27; versions when different packages depend on the same one, but with different versions.&lt;p&gt;They chose to not handle package dependencies at all, and I believe there&amp;#x27;s no version ranges either, so I really don&amp;#x27;t see why they added a lockfile.</text></item></parent_chain><comment><author>pharmakom</author><text>A version number is just a label, and labels are mutable.  A lock-file containing hashes will always resolve to the same packages (or fail).</text></comment>