courier VS pub

Edit: there is also https://github.com/themisir/courier

Agreed. Version resolution is the interesting problem.

Most package managers use a SAT solver to resolve dependencies. The Dart team has a detailed write up on their SAT-based approach which is worth a read [1]. For contrast, Russ Cox presents an algorithm that doesn't use a SAT solver (intended for Go) [2].

[1] https://github.com/dart-lang/pub/blob/master/doc/solver.md

[2] https://research.swtch.com/vgo-mvs

Official documentation.

As I understand Custom package repositories it's possible to host one's own package repository. The Repository Specification is public, but dart.dev only references cloud based paid services like Cloudsmith and OnePub.

As u/Which-Adeptness6908 already pointed out, the repository specification is small, and that's all you need to implement a server: https://github.com/dart-lang/pub/blob/master/doc/repository-spec-v2.md

https://docs.github.com/en/code-security/secret-scanning/sec...

A bit sad, they don't publish the list of regexes, etc.

--------------

I added a similar thing to the package manager for Dart / Flutter, because we saw users accidentally publishing secrets. That code is public, it relies on regexes and entropy estimation:

https://github.com/dart-lang/pub/blob/eb8ee21a089ebe0f2c2dd8...

It was heavily inspired by the researchers in:

Heres are some issues I've faced when trying with the dart-version cli: - The installation - dart pub global activate needs to have flutter/dart global installed already. - Global activated fvm cli got invalid after flutter upgrade, see issue - The cli does not work with customized fork of flutter. - You should run fvm flutter , not flutter , this changes CI/CD workflow

This will add the args dependency in your pubspec file. We used the Darts package manager pub to add this dependency.