pub

Can you recommend any resources on CDCL? I've just started reading up on Dart's primer [0] but I feel like it's slightly out of my grasp [0] https://github.com/dart-lang/pub/blob/master/doc/solver.md

Agreed. Version resolution is the interesting problem. Most package managers use a SAT solver to resolve dependencies. The Dart team has a detailed write up on their SAT-based approach which is worth a read [1]. For contrast, Russ Cox presents an algorithm that doesn't use a SAT solver (intended for Go) [2]. [1] https://github.com/dart-lang/pub/blob/master/doc/solver.md [2] https://research.swtch.com/vgo-mvs

Dart as in the language? Dart uses a SAT solver: https://github.com/dart-lang/pub/blob/master/doc/solver.md

> Or is that nonsense? Yes, that is nonsense. 1) secret scanning can be disabled (not even sure it's enabled by default). 2) the regexes are fairly specific, length limited, etc. 3) github is obviously reviewing regexes that are accepted. Check the list of stuff supported: https://docs.github.com/en/code-security/secret-scanning/sec... A bit sad, they don't publish the list of regexes, etc. -------------- I added a similar thing to the package manager for Dart / Flutter, because we saw users accidentally publishing secrets. That code is public, it relies on regexes and entropy estimation: https://github.com/dart-lang/pub/blob/eb8ee21a089ebe0f2c2dd8... It was heavily inspired by the researchers in: https://www.ndss-symposium.org/wp-content/uploads/2019/02/nd... Worth a read, and certainly provides motivation for Github to do this kind of w

> I don't think there's any clear argument you can make on first principles for which of those is actually the case. I don't understand why someone would try to argue from first principles here, it just seems like such a bizarre approach. Anyway, it's not just a security issue. Malicious packages and security fixes are only part of the picture. Other issues: - Despite a team's promise to use semantic versioning, point releases & "bugfix" releases will break downstream users - Other systems for determining the versions to use are much more unpredictable and hard to understand than estimated (look at Dart and Cargo) https://github.com/dart-lang/pub/blob/master/doc/solver.md https://github.com/rust-lang/cargo/blob/1ef1e0a12723ce9548d7...

A great related article is the introduction to PubGrub, the new solver algorithm for Dart's package manager. I especially liked the focus on better error messages, which can get pretty cryptic in other package managers. https://medium.com/@nex3/pubgrub-2fb6470504f The official docs are a rare learning resource, but require a bit more time to digest. https://github.com/dart-lang/pub/blob/master/doc/solver.md

The first package installer I was aware of that used a SAT solver was SUSE's, back when Yum's solver was extremely primitive and would regularly fail to find a solution. https://en.wikipedia.org/wiki/ZYpp I think using a SAT solver for package installation arose out of dealing with much more complex requirements than are likely to arise in a Go project. The Smart package installer used heuristics to find a solution depending upon the operation: https://bazaar.launchpad.net/~smartpm/smart/trunk/view/head:... Poetry, Cocoapods, and Dart are all apparently using this SAT solver: https://github.com/dart-lang/pub/blob/master/doc/solver.md FWIW, I wrote a package installer that worked with RPMs, Solaris packages and AIX packages about 15 years ago and ended up with a minimal version selection similar to vgo. I wasn't a genius or anything... I j