Egg #7: The Idris Package Manager

Although, Idris can install packages, one of the ‘Dragons in the room’ has been the lack of a package manager. Given that this is no small task I have created this feature proposal to help guide the discussion and present a sorting house’ of requirements and ideas.

Thus we as a community can establish here the requirements and topics for discussion for an Idris Package Manager. The idea being that for each ‘issue’ presented a corresponding issue on the issue tracker can be added to discuss and track its progress. Some of these topics may already have corresponding issues on the issue tracker. Please go there for discussion. I have also added leading questions to help facilitate discussion under these topics.

The ‘ipkg’ file format.

• What information should be stored within the ‘iPKG’ files? Currently the format stores: a module index, source directory, executable information, main module, build options, binding information.
• Is the current format acceptable, or should a another configuration format be used?

Format can be discussed at Issue #1825

Package Distribution

• Should a centralised system be used?
• How is this system to be realised?
• How is this system to be verified?
• What is the workflow for package submission?

Package Use and Versioning aka Dependancy Management

• Should we wait until modules have been properly implemented.
• How to deal with multiple versions of packages?

Dependancy management can be discussed at Issue #1832

Idris Package Operation

• What should the lib directory look like?
• Should idrisdoc be built and installed.
• Regardless of sub-commands or separate executable what is the expected behaviour of Idris w.r.t. to packages. Currently there is support for: install, build doc, check, clean, and build packages.

Executables

• Should the package manager handle executables?

Bike Shedding topics.

• What do we call this?

Implementation language

• How much of this can we write in Idris instead of Haskell?

Security Issues

• Should SHA-3 Hashes be generated to track consistency of package uploads.
• Should we request that packages be signed as well?