pub VS roo

Agreed. Version resolution is the interesting problem.

Most package managers use a SAT solver to resolve dependencies. The Dart team has a detailed write up on their SAT-based approach which is worth a read [1]. For contrast, Russ Cox presents an algorithm that doesn't use a SAT solver (intended for Go) [2].

[1] https://github.com/dart-lang/pub/blob/master/doc/solver.md

[2] https://research.swtch.com/vgo-mvs

Official documentation.

As I understand Custom package repositories it's possible to host one's own package repository. The Repository Specification is public, but dart.dev only references cloud based paid services like Cloudsmith and OnePub.

As u/Which-Adeptness6908 already pointed out, the repository specification is small, and that's all you need to implement a server: https://github.com/dart-lang/pub/blob/master/doc/repository-spec-v2.md

https://docs.github.com/en/code-security/secret-scanning/sec...

A bit sad, they don't publish the list of regexes, etc.

--------------

I added a similar thing to the package manager for Dart / Flutter, because we saw users accidentally publishing secrets. That code is public, it relies on regexes and entropy estimation:

https://github.com/dart-lang/pub/blob/eb8ee21a089ebe0f2c2dd8...

It was heavily inspired by the researchers in:

Heres are some issues I've faced when trying with the dart-version cli: - The installation - dart pub global activate needs to have flutter/dart global installed already. - Global activated fvm cli got invalid after flutter upgrade, see issue - The cli does not work with customized fork of flutter. - You should run fvm flutter , not flutter , this changes CI/CD workflow

This will add the args dependency in your pubspec file. We used the Darts package manager pub to add this dependency.

As promised, I tried to make the documentation a bit more accessible, given that I don't have a doc builder. It's now all in markdown.

If you need to manage complex, different environments, I wrote roo. It's not perfect and definitely not finished, but I've been using successfully for three years, and it's way more reliable than renv and install.packages. It supports multiple, separated environments, fully isolated, for different versions of R. It also does the transitive dependency check (no SAT solver yet, sorry) and creates lock in roo, packrat and renv format.