<story><title>Debian discusses vendoring again (2021)</title><url>https://lwn.net/Articles/842319/</url></story><parent_chain><item><author>nerdponx</author><text>This is one of the places that the often-maligned Homebrew package manager does a good job.&lt;p&gt;App dependencies in languages like Python and Lua are fetched manually, with exact filenames and hashes, and installed into an isolated location just for that app. If they turn out to be used by several apps, then they get packaged normally.&lt;p&gt;I wish other package managers did it this way. It would make packaging complicated applications much easier and result in many fewer dependency conflicts, and allows devs to produce more stable software.&lt;p&gt;It&amp;#x27;s basically static linking but for Python packages. Sometimes you want shared libraries, but for one-off dependencies it&amp;#x27;s possibly more trouble than it&amp;#x27;s worth.</text></item></parent_chain><comment><author>mikemcquaid</author><text>As the person who has probably influenced Homebrew&amp;#x27;s policy on this the most: I&amp;#x27;m very pleased to read this, thanks for saying it!&lt;p&gt;I was also reading this link today to think more about how Homebrew can handle this stuff better.&lt;p&gt;To me the main differentiation is &amp;quot;is the package for an application or a library?&amp;quot;. If it&amp;#x27;s a library: it&amp;#x27;s a trickier balance. If it&amp;#x27;s an application: vendoring the e.g. NPM&amp;#x2F;RubyGems modules is most likely to create the best, most useful experience for the user, upstream creator and Homebrew maintainers.</text></comment>
<story><title>Debian discusses vendoring again (2021)</title><url>https://lwn.net/Articles/842319/</url></story><parent_chain><item><author>nerdponx</author><text>This is one of the places that the often-maligned Homebrew package manager does a good job.&lt;p&gt;App dependencies in languages like Python and Lua are fetched manually, with exact filenames and hashes, and installed into an isolated location just for that app. If they turn out to be used by several apps, then they get packaged normally.&lt;p&gt;I wish other package managers did it this way. It would make packaging complicated applications much easier and result in many fewer dependency conflicts, and allows devs to produce more stable software.&lt;p&gt;It&amp;#x27;s basically static linking but for Python packages. Sometimes you want shared libraries, but for one-off dependencies it&amp;#x27;s possibly more trouble than it&amp;#x27;s worth.</text></item></parent_chain><comment><author>hedora</author><text>The article suggests using debian’s contrib package category in this way.   (Packages with such dependencies live in contrib, since they don’t live up to Debian’s quality standards, which is fine.)</text></comment>