[erlang-questions] more thoughts about package/dependency management

[Tuncer Ayaz]

On Tue, May 29, 2012 at 12:11 AM, Tim Watson wrote:
> http://hyperthunk.wordpress.com/2012/05/28/does-erlangotp-need-a-new-package-management-solution/
>
> This is a summary of the Erlware-Questions discussions - hopefully
> I've been true to what was said on the list, but if I've
> misrepresented anyone's opinion then I apologise and hope that
> you'll put it down to my 'special' short/medium term memory. :)
>
> Comments/Feedback welcome.

Thanks Tim for the summary. I mostly agree with you and Garrett and
think that distros and Hackage are a good source for inspiration.

A few important points:

- No need for storing (meta)data in a real vcs:
  + The index needs to be aware of all versions.
  + The versions should be kept as (archive) files in directories.
  + The index can be modified to add or remove entries. Replace
    doesn't seem like a good idea. It can be implemented, if needed.
  + Branches or merging shouldn't be required.
- We should consider leveraging existing ftp mirror networks like
  distros and texlive do. For both the files and index.
- We should look at dpkg (apt) and rpm (yum) for index and signature
  inspiration.
- Sandboxing should be part of the initial design.
- It has be trivial to get the tool(s) either as part of Erlang/OTP or
  with a simple download like rebar.
- It should not require any fragile dependency as you need working
  tools to get packages.
- The website can be made central, but should be avoided if possible.
- Hayoo like search would be nice to have in a 2nd step.

Do we need an infinite set of version or should it be limited like
distros do with the various channels and a pool of versions referred
to in the current indices?