Language Runtimes · Cluster
Packaging and Distribution
Dependency resolution, artifacts, and environments.
- 01 Dependency Resolution as Backtracking Search Over Version Sets Why choosing the newest version of each dependency in turn fails, how resolvers represent partial assignments, and what conflict-driven backjumping buys over chronological backtracking.
- 02 Version Precedence and the Semantics of Range Operators How version strings are ordered, why caret and tilde ranges expand the way they do, and where precedence rules diverge between ecosystems badly enough to change an install.
- 03 Lockfiles as Reproducibility Contracts and Why They Drift What a lockfile must record to make an install repeatable, which inputs it cannot capture, and how lockfiles fall out of sync with manifests without either side being wrong.
- 04 Registry Index Metadata and Resolution Without Downloading Artifacts How registries expose version lists, dependency metadata, and hashes as separate resources, and why fetching full archives during resolution is a design error.
- 05 Content Addressing and What Artifact Hashes Actually Prove The difference between a hash that identifies bytes and a signature that identifies a publisher, how digest verification fails, and why a matching hash is a narrower guarantee than it appears.
- 06 Platform Tags and Binary Compatibility in Distributed Artifacts How wheels encode interpreter, ABI, and platform into a compatibility tag, how that tag is matched against an ordered list of supported tags, and where the encoding leaks.
- 07 Vendored Source Trees and Offline Artifact Mirrors How copying dependencies into the repository changes the resolution problem, what it costs in update latency and duplication, and how mirrors extend the same idea to binary artifacts.
- 08 Reproducible Builds and the Sources of Byte-Level Nondeterminism Why two builds of identical source produce different archives, which fields carry the difference, and what verification requires beyond a matching hash.
- 09 Prefix-Based Environments and Why Activation Is Only Path Surgery How a virtual environment isolates packages by rewriting interpreter paths and sys.path, why moving one breaks its scripts, and what containers change about the same problem.
- 10 Provenance Attestations and the Trust Boundary of a Package Install What an in-toto attestation binds together, how transparency logs change the meaning of a verified install, and which attacks remain outside the model.