-
-
Notifications
You must be signed in to change notification settings - Fork 230
Package Management Guide (doc) #502
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
|
@nektro since I believe you are well informed about zig’s package management, I would love your feedback—all good either way. |
linusg
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Given the consistent use of Zig version 0.11.0 (latest is 0.14.1), APIs/manifest format that no longer exist, and lengthy generic "best practices" at the end I suspect this was AI generated.
| .dependencies = .{ | ||
| .lodash = .{ | ||
| .url = "https://example.com/lodash-4.17.21.tar.gz", | ||
| .hash = "12203f48c6cf5de9a2d4558209f72b18e2c9f3f8e6c6f71450628dffbfce00b40", // Always gets EXACTLY this code |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This is an old-style hash.
|
|
||
| ### What Makes Zig’s Package Manager Different? | ||
|
|
||
| Most package managers rely on central registries and version numbers to manage dependencies. Zig takes a fundamentally different approach: it’s **decentralized** and **content-addressed**. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Pretty much all modern package managers have lock files so the comparison below doesn't make much sense. The version / resolved / integrity fields in an npm package-lock.json basically match what build.zig.zon does.
|
|
||
| ### The Package Manifest | ||
|
|
||
| Every Zig project with dependencies has a `build.zig.zon` file that serves as the package manifest. This file defines: |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Zig projects that use git submodules or third-party package managers like zigmod (unfortunately) still exist in the wild. I don't think those should be covered in official docs but as worded this isn't true.
| const exe = b.addExecutable(.{ | ||
| .name = "my-app", | ||
| .root_source_file = b.path("src/main.zig"), |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This API no longer exists
| .name = "my-project", | ||
| .version = "0.1.0", | ||
| .minimum_zig_version = "0.11.0", |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This is missing a fingerprint
| **For Teams:** | ||
|
|
||
| 1. **Version Control**: Always commit `build.zig.zon` to your repository | ||
| 1. **Never Commit Cache**: Add `zig-cache/` to `.gitignore` |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
zig-cache no longer exists
|
@linusg thanks for the review. I did use Claude/Gemini to review it, which I think is helpful. I'm new to zig so some of the technical specifics are beyond my knowledge. I will hand polish the overly-verbose bits. |
This PR adds a package management guide.
it’s currently in .md format and will be converted to .smd once technical and structural aspects are finalized.