The DUB package manager

[Sönke Ludwig]

Am 17.02.2013 13:47, schrieb Jacob Carlborg:
> On 2013-02-17 09:02, Sönke Ludwig wrote:
> 
>> But you will have to learn the API of the build script helpers, too. I'm
>> not sure if this is actually less to learn than the JSON alternative.
> 
> You still have to learn this:
> 
> http://registry.vibed.org/package-format
> 

Yes, I meant that with the JSON alternative. JSON itself is so simple
and widely known, that I think it can be neglected compared to the
possible fields.

>>   - Meta information needs to be available to the package registry and
>> for managing dependencies in general. Executing a script/program would
>> imply a big performance risk, and worse, is a high security risk in case
>> of the registry. So a data-driven approach is needed at least for the
>> meta data anyway.
> 
> You can just serialize the D data structure to XML/JSON to make it safe
> for the registry.
> 

But that would need to happen as a separate step and then there would be
two redundant files in the repository, with the usual danger of
inconsistencies between the two.

Since a build script may behave differently on different systems, it
could also happen that the contents cannot really be described as
JSON/XML. For example someone might get the idea to search the system
for some library and only add a corresponding dependency if it is found.
There would be no way for the registry to represent that.