Package Managers à la Carte: A Formal Model of Dependency Resolution
Fuente:
arXiv
Gespeichert in:
| Hauptverfasser: | , , , , |
|---|---|
| Format: | Preprint |
| Veröffentlicht: |
2026
|
| Schlagworte: | |
| Online-Zugang: | |
| Tags: |
Tag hinzufügen
Keine Tags, Fügen Sie den ersten Tag hinzu!
|
| _version_ | 1866908846102937600 |
|---|---|
| author | Gibb, Ryan Ferris, Patrick Allsopp, David Gazagnaire, Thomas Madhavapeddy, Anil |
| author_facet | Gibb, Ryan Ferris, Patrick Allsopp, David Gazagnaire, Thomas Madhavapeddy, Anil |
| contents | Package managers are legion. Every programming language and operating system has its own solution, each with subtly different semantics for dependency resolution. This fragmentation prevents multilingual projects from expressing precise dependencies across language ecosystems; it leaves external system and hardware dependencies implicit and unversioned; it obscures security vulnerabilities that lie in the full dependency graph. We present the \textit{Package Calculus}, a formalism for dependency resolution that unifies the core semantics of diverse package managers. Through a series of formal reductions, we show how this core is expressive enough to model the diversity that real-world package managers employ in their dependency expression languages. By using the Package Calculus as the intermediate representation of dependencies, we enable translation between distinct package managers and resolution across ecosystems. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2602_18602 |
| institution | arXiv |
| publishDate | 2026 |
| record_format | arxiv |
| spellingShingle | Package Managers à la Carte: A Formal Model of Dependency Resolution Gibb, Ryan Ferris, Patrick Allsopp, David Gazagnaire, Thomas Madhavapeddy, Anil Programming Languages Software Engineering Package managers are legion. Every programming language and operating system has its own solution, each with subtly different semantics for dependency resolution. This fragmentation prevents multilingual projects from expressing precise dependencies across language ecosystems; it leaves external system and hardware dependencies implicit and unversioned; it obscures security vulnerabilities that lie in the full dependency graph. We present the \textit{Package Calculus}, a formalism for dependency resolution that unifies the core semantics of diverse package managers. Through a series of formal reductions, we show how this core is expressive enough to model the diversity that real-world package managers employ in their dependency expression languages. By using the Package Calculus as the intermediate representation of dependencies, we enable translation between distinct package managers and resolution across ecosystems. |
| title | Package Managers à la Carte: A Formal Model of Dependency Resolution |
| topic | Programming Languages Software Engineering |
| url | https://arxiv.org/abs/2602.18602 |