Skip to content

Conversation

@jimkring
Copy link

This PR adds a package management guide.

it’s currently in .md format and will be converted to .smd once technical and structural aspects are finalized.

@jimkring jimkring marked this pull request as draft July 15, 2025 00:59
@jimkring
Copy link
Author

@nektro since I believe you are well informed about zig’s package management, I would love your feedback—all good either way.

Copy link

@linusg linusg left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Given the consistent use of Zig version 0.11.0 (latest is 0.14.1), APIs/manifest format that no longer exist, and lengthy generic "best practices" at the end I suspect this was AI generated.

.dependencies = .{
.lodash = .{
.url = "https://example.com/lodash-4.17.21.tar.gz",
.hash = "12203f48c6cf5de9a2d4558209f72b18e2c9f3f8e6c6f71450628dffbfce00b40", // Always gets EXACTLY this code
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is an old-style hash.


### What Makes Zig’s Package Manager Different?

Most package managers rely on central registries and version numbers to manage dependencies. Zig takes a fundamentally different approach: it’s **decentralized** and **content-addressed**.
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pretty much all modern package managers have lock files so the comparison below doesn't make much sense. The version / resolved / integrity fields in an npm package-lock.json basically match what build.zig.zon does.


### The Package Manifest

Every Zig project with dependencies has a `build.zig.zon` file that serves as the package manifest. This file defines:
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Zig projects that use git submodules or third-party package managers like zigmod (unfortunately) still exist in the wild. I don't think those should be covered in official docs but as worded this isn't true.

const exe = b.addExecutable(.{
.name = "my-app",
.root_source_file = b.path("src/main.zig"),
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This API no longer exists

Comment on lines +114 to +116
.name = "my-project",
.version = "0.1.0",
.minimum_zig_version = "0.11.0",
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is missing a fingerprint

**For Teams:**

1. **Version Control**: Always commit `build.zig.zon` to your repository
1. **Never Commit Cache**: Add `zig-cache/` to `.gitignore`
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

zig-cache no longer exists

@jimkring
Copy link
Author

@linusg thanks for the review. I did use Claude/Gemini to review it, which I think is helpful. I'm new to zig so some of the technical specifics are beyond my knowledge. I will hand polish the overly-verbose bits.

@andrewrk
Copy link
Member

No LLM/AI Policy

@andrewrk andrewrk closed this Jul 15, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants