From owner-freebsd-mono@freebsd.org Sat Sep 2 09:04:01 2017 Return-Path: Delivered-To: freebsd-mono@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id BCA0DE08730 for ; Sat, 2 Sep 2017 09:04:01 +0000 (UTC) (envelope-from romain@marvin.blogreen.org) Received: from marvin.blogreen.org (blogreen.org [IPv6:2001:41d0:fea8:8901::2]) by mx1.freebsd.org (Postfix) with ESMTP id 2A8B57E5A5 for ; Sat, 2 Sep 2017 09:04:01 +0000 (UTC) (envelope-from romain@marvin.blogreen.org) Received: by marvin.blogreen.org (Postfix, from userid 1001) id 31E12998DD; Sat, 2 Sep 2017 11:03:59 +0200 (CEST) Date: Sat, 2 Sep 2017 11:03:59 +0200 From: Romain =?iso-8859-1?Q?Tarti=E8re?= To: freebsd-mono@freebsd.org Subject: Re: Update on porting mono 5 Message-ID: <20170902090359.GA47675@blogreen.org> Mail-Followup-To: freebsd-mono@freebsd.org References: <17078253.u2dgjZK1Z6@dragon.local> <20170815102120.GA29251@blogreen.org> <3186981.TyGdqNibkJ@dragon.local> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="FCuugMFkClbJLl1L" Content-Disposition: inline In-Reply-To: <3186981.TyGdqNibkJ@dragon.local> X-PGP-Key: http://romain.blogreen.org/pubkey.asc User-Agent: Mutt/1.8.3 (2017-05-23) X-BeenThere: freebsd-mono@freebsd.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: Mono and C# applications on FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 02 Sep 2017 09:04:01 -0000 --FCuugMFkClbJLl1L Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Fri, Aug 25, 2017 at 09:41:43PM +0200, David Naylor wrote: > [2] A general discussion needs to be had around nuget packages. How do w= e=20 > consume them? > i) as downloads with each port containing a copy > ii) local ports with consistency across the Ports Collections > iii) A mixture of the above (i.e. (ii) is there is a native component,=20 > otherwise (i)) > I prefer (ii) as I think it gives the end user the best leverage to patch= =20 > issues with nuget packages locally (and to get updates without waiting on= a)=20 > upstream, and b) us/ports maintainer). However, at this point that optio= n is=20 > at 0% progress. =20 Yeah, it's a problem that is broader and broader=E2=80=A6 and for which I = don't think a universal solution works :-/ With local copies (i) you end-up with a lot of duplication (Go applications are a good example of how this can become quite stupid, I recently created a port for a go application, the source tarball includes the source of all dependencies, and everything is bundled in a 13MB executable (that only depends on libc.so and libthr.so). With a port per dependency (ii), you sooner or later have to handle conflicts between dependencies (port A needs foo-1.0.0 but port B needs foo-2.0.0) and it can get tricky. I only have experience with programming with Ruby as a language that has similar problem. I ended at only installing system tools using the FreeBSD ports (e.g. puppet, vagrant, passenger), and for applications I actually use, I just grab the source, and use bundler to gather all dependencies as the user running the software, therefore I end up having something similar to (i) without using the port system. My weak Windows development experience learned me to put all dll of an application in the application directory. If it's still a good advice, I guess that each application should have it's copy of all it's dependencies, and therefore each port should install a bundle of all what is required by it. Another problem with nugets packages is that you only get binaries, right? That means that is something goes really wrong, there is no way to audit the source code of what led to disaster. The problem is similar with the few Java projects I gave a look at. My feeling is that this is even worst :-( Ruby being interpreted, there is no such problems. I am not enough involved in Java nor .Net to think about mitigations of this issue. --=20 Romain Tarti=C3=A8re http://people.FreeBSD.org/~romai= n/ pgp: 8234 9A78 E7C0 B807 0B59 80FF BA4D 1D95 5112 336F (ID: 0x5112336F) (plain text =3Dnon-HTML=3D PGP/GPG encrypted/signed e-mail much appreciated) --FCuugMFkClbJLl1L Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQGzBAEBCAAdFiEEgjSaeOfAuAcLWYD/uk0dlVESM28FAlmqc/8ACgkQuk0dlVES M28G1gwAmFabyXhW34ckhuJ8lAzdP9OKOF3pefLVk7+1uBthQc+CDvmoV6bsqD3G oPrxiKLHfrhB5fe8F7n5aHDWgL+kaNl5d+eWtzYkoF74NNcw64YV3wU2AfpPOIdn oer7eezjXwJE24nvJugRedNDfx8vyK+R680jlyXyQGJ8UdZfFQIrFsCvh8qUEKVL /NyVeM/+QkIPyefZSxBLzg7ZgeeGn7h5nQcPYVCQUohw1334Fanm9SaHtnzRiasR WE3pSQ7Vak82uuURDlzeZt39Vnqaqyw9wKH2dbmQv3el/E0bA9DBu8+okk++fnzF Tx3Bs0nA7XpgcxiKNDGGcgQFZ0ZXUH5ss8t9AvD28UfOf/D4QOMMWJFdwEL+se9G KXegTsoXsuOO9hWH18q3HXza2A3FDV/Bbfxwgoy5NfT0lAM2sARuLmN/ZUBJuemm rgN0WnnrjxOEvRf2gpm6g+6+KuQfaoPr9UXfDfDSv7RZ2Q2wi2341RXyw1sYJQH+ e1lyn47O =Z/Fe -----END PGP SIGNATURE----- --FCuugMFkClbJLl1L-- From owner-freebsd-mono@freebsd.org Sat Sep 2 11:55:17 2017 Return-Path: Delivered-To: freebsd-mono@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 4035DE0F10F for ; Sat, 2 Sep 2017 11:55:17 +0000 (UTC) (envelope-from eralegrid@hotmail.com) Received: from NAM01-BY2-obe.outbound.protection.outlook.com (mail-oln040092001020.outbound.protection.outlook.com [40.92.1.20]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (Client CN "mail.protection.outlook.com", Issuer "Microsoft IT SSL SHA2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 0748A83AAC; Sat, 2 Sep 2017 11:55:16 +0000 (UTC) (envelope-from eralegrid@hotmail.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hotmail.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=Q/ReHfRi/Y4RqvKUrypFTR+42NwCLAJ0aXhP+CgIqeM=; b=pvHKb8mRBo8xn1NdonuutwVnxCZhNKIvlQxvv0wmDWddeYM2hyx1PuOAgsvI+ftLblwEMMoUyUW5+yNAJpLpw0IpKK0txEiCqehnuaByAOcxt97PbM3CJ0YCBfQ46dBht1oEk9DeYBwE+B8zMVr7IhPhqzY07LuVJSb83Mxswtz/wacuF/n8dey62NtbaMAudx04LUAF1MUfrsMm7fcjuKRDZ+7VyN54zrtR2Qefjo7SFxAL0eWvQjib57SjC9Xw2GCnMUSXsQwlVYxGY9FBCsnnDBs3mmdZtCsYdQsL/vFPKABEQz9xKsSi8stthUH2pPhrDX7KGWTHZSiom1bolw== Received: from BY2NAM01FT034.eop-nam01.prod.protection.outlook.com (10.152.68.59) by BY2NAM01HT146.eop-nam01.prod.protection.outlook.com (10.152.68.211) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.1385.11; Sat, 2 Sep 2017 11:55:15 +0000 Received: from RO1P15201MB2187.LAMP152.PROD.OUTLOOK.COM (10.152.68.54) by BY2NAM01FT034.mail.protection.outlook.com (10.152.69.3) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1385.11 via Frontend Transport; Sat, 2 Sep 2017 11:55:15 +0000 Received: from RO1P15201MB2187.LAMP152.PROD.OUTLOOK.COM ([10.164.236.147]) by RO1P15201MB2187.LAMP152.PROD.OUTLOOK.COM ([10.164.236.147]) with mapi id 15.20.0013.018; Sat, 2 Sep 2017 11:55:15 +0000 From: Robert Alegrid To: =?Windows-1252?Q?Romain_Tarti=E8re?= , "freebsd-mono@freebsd.org" Subject: Re: Update on porting mono 5 Thread-Topic: Update on porting mono 5 Thread-Index: AQHTI8pxfdWvWT4QFUuqnwnvNPS3VaKhfEu4 Date: Sat, 2 Sep 2017 11:55:15 +0000 Message-ID: References: <17078253.u2dgjZK1Z6@dragon.local> <20170815102120.GA29251@blogreen.org> <3186981.TyGdqNibkJ@dragon.local>,<20170902090359.GA47675@blogreen.org> In-Reply-To: <20170902090359.GA47675@blogreen.org> Accept-Language: en-AU, en-US Content-Language: en-AU X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: FreeBSD.org; dkim=none (message not signed) header.d=none;FreeBSD.org; dmarc=none action=none header.from=hotmail.com; x-incomingtopheadermarker: OriginalChecksum:E718EF3A6B94831D3B44E5F567966A9B99E85AA3B8CF9B7C4A79C0EE4C6E6846; UpperCasedChecksum:CAADB99D937858113A3C2A519E8439B507494C3F3ABDAE21C89819E74D32E35D; SizeAsReceived:7119; Count:46 x-ms-exchange-messagesentrepresentingtype: 1 x-tmn: [+0Ju+1SHrO1yQFlC/COulrZfLBQdsLVz] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; BY2NAM01HT146; 6:aldrQOcaANKchYmJ+Pd8dDful/5CbCR6IktMNO0CxB6yQzQ7F3qGvLYrwMmsfUxWr0Y2JEZUClktNGwILP8JFTLOZuVYUl9O7IbhbVW9OYGG+nSvOJ8DCTdRX24+aWcZ/2/98Mppsy2kTndMORkIS+KfhB1IHl+fh7WUygOzNVCXMroXw+a2mG35/dAsOYOfWXbRpc83fdjJwDq4J+h+Bo21zt9F3l4T+rR8sZ3IExQc/1zmXmyWQz+/RXD34/2VytWVzCoJAjuOCJ+elZp1YUR9pgZnSc5xiRmHSchFLQRE9d3TtM5z48ZTcsbpwTCMqQGxrj378WZnw3pjICN4GA==; 5:SPXIFZ5eSbdsY8VtaVV603xutWXMUn3XZ8HP4Y2ZaB421Ov8XKY5Q4B4HiIUCJ+HVvIgxucYsKI2VtTJwSXVABPEEIpd87lm49dCzh9ZIwWuQLrO8aOi361P0WDCTBNHFtmJRxj5Qc96aO7vG9FPbg==; 24:2nhjLCzt4REPMFWQcF7ezcJBQrch+9BsI3wW/v8t4x8tKcsarQ6S1nZ843mQ4tK85bzL4autRT7JUedE7V0v0HM0sbKhdKA8onOV9sbPXBw=; 7:cYB+kAPbrIEOo33N1xCoxg4rNWPhbrTgTeR051BZwZWR79aQLSmgzrt5u38A1b+2K/yJel+KPzOdADArSS/tx+45whEdaJpL6URR/PNyE/ZAZwGcwr+TImb+qpxX7Tatro46CORnonNzvrpr61Rs4z8dyErKYq+Za744Q1fQPe+50IB5qdzsKSo3DZhsj11C6sK6qqB1SOssGHMpg9OLr0NKdbdYtDIIlbMMgoZODM8= x-incomingheadercount: 46 x-eopattributedmessage: 0 x-ms-office365-filtering-correlation-id: 2fdf34c8-45a9-432e-ccaf-08d4f1f97972 x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(300000500095)(300135000095)(300000501095)(300135300095)(22001)(300000502095)(300135100095)(300000503095)(300135400095)(201702061074)(5061506573)(5061507331)(1603103135)(2017031320274)(2017031324274)(2017031323274)(2017031322404)(1601125374)(1603101448)(1701031045)(300000504095)(300135200095)(300000505095)(300135600095)(300000506095)(300135500095); SRVR:BY2NAM01HT146; x-ms-traffictypediagnostic: BY2NAM01HT146: x-exchange-antispam-report-test: UriScan:(278428928389397)(5213294742642)(94056789713001); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(100000700101)(100105000095)(100000701101)(100105300095)(100000702101)(100105100095)(444000031); SRVR:BY2NAM01HT146; BCL:0; PCL:0; RULEID:(100000800101)(100110000095)(100000801101)(100110300095)(100000802101)(100110100095)(100000803101)(100110400095)(100000804101)(100110200095)(100000805101)(100110500095); SRVR:BY2NAM01HT146; x-forefront-prvs: 04180B6720 x-forefront-antispam-report: SFV:NSPM; SFS:(7070007)(98901004); DIR:OUT; SFP:1901; SCL:1; SRVR:BY2NAM01HT146; H:RO1P15201MB2187.LAMP152.PROD.OUTLOOK.COM; FPR:; SPF:None; LANG:; spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: hotmail.com X-MS-Exchange-CrossTenant-originalarrivaltime: 02 Sep 2017 11:55:15.1706 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Internet X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa X-MS-Exchange-Transport-CrossTenantHeadersStamped: BY2NAM01HT146 X-BeenThere: freebsd-mono@freebsd.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: Mono and C# applications on FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 02 Sep 2017 11:55:17 -0000 I apologize in advance if I formatted this message incorrectly or addressed= it incorrectly. This is the first time I'm posting to a mailing list, so I hav= e no real idea how I should be doing it. I also just program as a hobby (and mostly on Windows at that), so that sho= uld be taken in consideration as well. On Saturday, 2 September 2017 7:03 PM, Romain Tarti=E8re wrote: >On Fri, Aug 25, 2017 at 09:41:43PM +0200, David Naylor wrote: >> [2] A general discussion needs to be had around nuget packages.=A0 How d= o we=20 >> consume them? >>=A0=A0 i) as downloads with each port containing a copy >>=A0 ii) local ports with consistency across the Ports Collections >> iii) A mixture of the above (i.e. (ii) is there is a native component,=20 >> otherwise (i)) >> I prefer (ii) as I think it gives the end user the best leverage to patc= h=20 >> issues with nuget packages locally (and to get updates without waiting o= n a)=20 >> upstream, and b) us/ports maintainer).=A0 However, at this point that op= tion is=20 >> at 0% progress.=A0=20 It's possible for NuGet to use a local directory as a feed: https://docs.microsoft.com/en-us/nuget/hosting-packages/local-feeds If you add the local feed earlier in the list of sources, it should pick up= your locally built packages instead of fetching it from the internet. NuGet also maintains a cache of packages that it uses to restore from when = it doesn't have an internet connection to work with. >Yeah, it's a problem that is broader and broader=85=A0 and for which I don= 't >think a universal solution works :-/ > >With local copies (i) you end-up with a lot of duplication (Go >applications are a good example of how this can become quite stupid, I >recently created a port for a go application, the source tarball >includes the source of all dependencies, and everything is bundled in a >13MB executable (that only depends on libc.so and libthr.so). > >With a port per dependency (ii), you sooner or later have to handle >conflicts between dependencies (port A needs foo-1.0.0 but port B needs >foo-2.0.0) and it can get tricky. When building a prgram, you can save=20 You're going to end up with a lot of duplication either way, given how asse= mbly locations are resolved: http://www.mono-project.com/docs/advanced/assemblies-and-the-gac/ >I only have experience with programming with Ruby as a language that has >similar problem.=A0 I ended at only installing system tools using the >FreeBSD ports (e.g. puppet, vagrant, passenger), and for applications I >actually use, I just grab the source, and use bundler to gather all >dependencies as the user running the software, therefore I end up having >something similar to (i) without using the port system. > >My weak Windows development experience learned me to put all dll of an >application in the application directory.=A0 If it's still a good advice, >I guess that each application should have it's copy of all it's >dependencies, and therefore each port should install a bundle of all >what is required by it. Aside from a few special assemblies which live in the GAC, yes, that's basi= cally what you're supposed to do. >Another problem with nugets packages is that you only get binaries, >right?=A0 That means that is something goes really wrong, there is no way >to audit the source code of what led to disaster.=A0 The problem is >similar with the few Java projects I gave a look at.=A0 My feeling is that >this is even worst :-(=A0 Ruby being interpreted, there is no such >problems. NuGet packages have in their manifest a field to specify where the source c= ode lives. However, since it's optional and is just a URL to the repository, it probably doesn't help much for this use case. Regards, Robert Alegrid= From owner-freebsd-mono@freebsd.org Sat Sep 2 14:40:31 2017 Return-Path: Delivered-To: freebsd-mono@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 96CFDE168F2 for ; Sat, 2 Sep 2017 14:40:31 +0000 (UTC) (envelope-from russ.haley@gmail.com) Received: from mail-lf0-x22d.google.com (mail-lf0-x22d.google.com [IPv6:2a00:1450:4010:c07::22d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 1A63464FB0; Sat, 2 Sep 2017 14:40:31 +0000 (UTC) (envelope-from russ.haley@gmail.com) Received: by mail-lf0-x22d.google.com with SMTP id d17so8627036lfe.1; Sat, 02 Sep 2017 07:40:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-transfer-encoding; bh=efMdUW4AkIdtkC0nH4KzPN2JE4pkXX2eL9BdEK8zEEE=; b=PWm7KcrQqFBzM6DHX4g2T1HWuUSLBGEf7p/uS2A0jghZg9JE/WVT1jitAcY83VlEny aZ+ZYJUpJUt688s6uSgK705aS6VJ34LQxRAOdHDBjEtDiF+5AxSeOc20Ec/3zrG459jO Ds+j9JpTxGc0Q4wDzc4cC0Fre2eRK0Wy/w3RYIi9tuES+yfTCKxllIADb7zOpg6K8bE2 FZ2s9WY7wWFpuXtX8KVdAzb3DLYaPlhSUxdP281xnEOANsCF3NtC+PKArZt5OTN7Qnw4 TPyR7HhRGoLVsGMfn11ikcm2IfT/esV2XQRtMyNsCtJ1vpaH/PHIEpd8J7+DBrVzGm6I 9BEw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-transfer-encoding; bh=efMdUW4AkIdtkC0nH4KzPN2JE4pkXX2eL9BdEK8zEEE=; b=TwtRicIiPZOUo2iW40Tgv2smc3fPUd9naYocf1Lo1ldSgSlHvnDnLL/z2rOEfhg9IM RXDrohStKu0mUTDMRYwle9tz4DffoP8uw2eg/UsOGxR2VwWlQR+x277rcCJO7zW8hFYR 8IHGKLsQKELMDJLlk/PP7Z80R/4KR3lLvYSRhHkdK9xQ5eiFQaqb+9rpHxFfM4MnjR1G VW9ZVSI3Kz4lKQkBo7jptw67saNWR5Xu+2ERACox7ayGob5NP5YoK+d7XwfJKNwwIZfP sgsfcZqvG8LqUCS02MCJ35u+3ttwhh1hluMDYmvBoeuVaXhZiGZkote4P7ckrU6NpHft goEA== X-Gm-Message-State: AHPjjUj1fBKH+X429lJ7lKJziOrfCwIJpmqALA5nLWA1s8idGtwRD4s3 0gA9zBuA8Jf7dTDCGpaMYBOdQEXHTA== X-Google-Smtp-Source: ADKCNb4dc/DTHlFRYkEB8oUp2dQlI4Gedj3od+fk0arQBGMfMdnSgeKIAmsMg3PZX5UfbOZlNVkF0UCxEvqWzSncf8A= X-Received: by 10.25.199.67 with SMTP id x64mr2097125lff.188.1504363229200; Sat, 02 Sep 2017 07:40:29 -0700 (PDT) MIME-Version: 1.0 Received: by 10.46.81.18 with HTTP; Sat, 2 Sep 2017 07:40:28 -0700 (PDT) In-Reply-To: References: <17078253.u2dgjZK1Z6@dragon.local> <20170815102120.GA29251@blogreen.org> <3186981.TyGdqNibkJ@dragon.local> <20170902090359.GA47675@blogreen.org> From: Russell Haley Date: Sat, 2 Sep 2017 07:40:28 -0700 Message-ID: Subject: Re: Update on porting mono 5 To: Robert Alegrid Cc: =?UTF-8?Q?Romain_Tarti=C3=A8re?= , "freebsd-mono@freebsd.org" Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-BeenThere: freebsd-mono@freebsd.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: Mono and C# applications on FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 02 Sep 2017 14:40:31 -0000 On Sat, Sep 2, 2017 at 4:55 AM, Robert Alegrid wrot= e: > I apologize in advance if I formatted this message incorrectly or address= ed it > incorrectly. This is the first time I'm posting to a mailing list, so I h= ave no > real idea how I should be doing it. > > I also just program as a hobby (and mostly on Windows at that), so that s= hould > be taken in consideration as well. > > On Saturday, 2 September 2017 7:03 PM, Romain Tarti=C3=A8re wrote: >>On Fri, Aug 25, 2017 at 09:41:43PM +0200, David Naylor wrote: >>> [2] A general discussion needs to be had around nuget packages. How do= we >>> consume them? >>> i) as downloads with each port containing a copy >>> ii) local ports with consistency across the Ports Collections >>> iii) A mixture of the above (i.e. (ii) is there is a native component, >>> otherwise (i)) >>> I prefer (ii) as I think it gives the end user the best leverage to pat= ch >>> issues with nuget packages locally (and to get updates without waiting = on a) >>> upstream, and b) us/ports maintainer). However, at this point that opt= ion is >>> at 0% progress. > It's possible for NuGet to use a local directory as a feed: > https://docs.microsoft.com/en-us/nuget/hosting-packages/local-feeds > If you add the local feed earlier in the list of sources, it should pick = up your > locally built packages instead of fetching it from the internet. > > NuGet also maintains a cache of packages that it uses to restore from whe= n it > doesn't have an internet connection to work with. > >>Yeah, it's a problem that is broader and broader=E2=80=A6 and for which = I don't >>think a universal solution works :-/ >> >>With local copies (i) you end-up with a lot of duplication (Go >>applications are a good example of how this can become quite stupid, I >>recently created a port for a go application, the source tarball >>includes the source of all dependencies, and everything is bundled in a >>13MB executable (that only depends on libc.so and libthr.so). >> >>With a port per dependency (ii), you sooner or later have to handle >>conflicts between dependencies (port A needs foo-1.0.0 but port B needs >>foo-2.0.0) and it can get tricky. > When building a prgram, you can save > You're going to end up with a lot of duplication either way, given how as= sembly > locations are resolved: > http://www.mono-project.com/docs/advanced/assemblies-and-the-gac/ > >>I only have experience with programming with Ruby as a language that has >>similar problem. I ended at only installing system tools using the >>FreeBSD ports (e.g. puppet, vagrant, passenger), and for applications I >>actually use, I just grab the source, and use bundler to gather all >>dependencies as the user running the software, therefore I end up having >>something similar to (i) without using the port system. >> >>My weak Windows development experience learned me to put all dll of an >>application in the application directory. If it's still a good advice, >>I guess that each application should have it's copy of all it's >>dependencies, and therefore each port should install a bundle of all >>what is required by it. > Aside from a few special assemblies which live in the GAC, yes, that's ba= sically > what you're supposed to do. > >>Another problem with nugets packages is that you only get binaries, >>right? That means that is something goes really wrong, there is no way >>to audit the source code of what led to disaster. The problem is >>similar with the few Java projects I gave a look at. My feeling is that >>this is even worst :-( Ruby being interpreted, there is no such >>problems. > NuGet packages have in their manifest a field to specify where the source= code > lives. However, since it's optional and is just a URL to the repository, = it > probably doesn't help much for this use case. Is this coming up because of the use of Nuget during the build process or is it because of general concern for the user? As a professional DotNet developer, I agree with Mr. Alegrid for the most part. Nuget is designed as a binary tool because DotNet is a binary based system. It comes from a user mindset, not an opensource mindset. Because of that, I question why we are having this discussion. Is it not the decision of the user/developer how they would like to use their package manager? Also, it is their choice if they prefer to use sources. I sometimes do both. Stable packages from Nuget and others from source. Nuget is designed for local, per project resources. It is particularly effective when developing across many developers as it will go and get the packages for you automatically at build time (wicked cool feature, which seamlessly mixes source with binary distribution). Items that are supposed to live system wide are to be stored in the General Assembly Cache (GAC) and should be designed to be put there. You can get Nuget to drop things in the GAC but have not used this feature. The GAC is designed around large scale software deployments which, sadly, I don't think will ever apply to mono on FreeBSD. Worrying about per-port repositories for Nuget is not a thing because the manifest within DotNet applications decides what runtime version of the assembly to use at build time so it is necessarily per-port. Also, DotNet can have hard or soft links (I forget the terminology) to required assemblies in the sense they can specify to use any version or a specific version, and can specify if the assemblies require to be signed (i.e. verified by the authors credentials against a trusted list). The GAC handles versioning for system level assemblies and if you overwrite a required version in your local repository it's a development error that you need to sort yourself. I had another point but I forgot it so I may speak up again later if anyone finds the above relevant to the discussion. Cheers, Russ