[swift-users] SwiftPM manual dependency management

Geordie J geojay at gmail.com
Fri Jul 21 09:39:11 CDT 2017 

Hi Ankit,

> Am 21.07.2017 um 15:32 schrieb Ankit Aggarwal via swift-users <swift-users at swift.org>:
> 
> +swift-build-dev
> 
>> On 21-Jul-2017, at 6:09 PM, Geordie J <geojay at gmail.com <mailto:geojay at gmail.com>> wrote:
>> 
>> Hi Ankit, thanks for your reply.
>> 
>>> Am 21.07.2017 um 07:33 schrieb Ankit Aggarwal via swift-users <swift-users at swift.org <mailto:swift-users at swift.org>>:
>>> 
>>> 
>>> 
>>> On Thu, Jul 20, 2017 at 10:34 PM, Geordie J via swift-users <swift-users at swift.org <mailto:swift-users at swift.org>> wrote:
>>> Hi all,
>>> 
>>> My team and I are trying to use SwiftPM to develop a relatively complex app with multiple dependencies, all of which are being developed locally and in parallel. The reason for this is compatibility with an existing module/import structure used by our iOS app. Maybe I’m doing something very wrong but my experience so far (2 months in) is that this is extremely difficult with SwiftPM.
>>> 
>>> What I’d love to be able to do is to just run `git add submodule http://blah.com/mysubmodule.git` <http://blah.com/mysubmodule.git%60> in the Packages subdirectory and SwiftPM would just let me manage dependencies from there myself.
>>> 
>>> I was excited to see that SwiftPM 4 has a "Top of Tree" development option for this purpose. So far my experience with this has not been good. Firstly because SwiftPM still unnecessarily tries to clone my repos itself (some of which are huge), and secondly because this creates an absolute path dependency in `.build/dependencies-state.json`, meaning this setup isn’t sharable within our dev team.
>>> 
>>> Attempting this with "local" git urls adds an almost absurd level of complexity, having to tag each commit for SwiftPM to build. The fact that we'd need to make a commit to test whether the project even builds is insane enough as is, let alone the tagging and trying to tell the base project to use a newer minor version etc etc.
>>> 
>>> Adding multiple subtargets is also not an option because the dependencies (as dynamic libraries) really are shared between multiple targets/sub-dependencies, which SwiftPM seems to deal with quite well.
>>> 
>>> tldr; *Please* let us manage dependencies ourselves. It’d be so easy if Package.swift had an option along the lines of .Package.local(named: "XYZ") that it then looked for in ./Packages/XYZ. Again, maybe I’m overlooking something but this seems like an obvious and vital option to have. It’d also simplify the introductory SwiftPM docs significantly.
>>> 
>>> Is anyone else having this issue? Would this change really be as simple and painless as it sounds? I would be prepared to make a pull request along these lines.
>>> 
>>> I think you're not really using the Top of Tree feature. You need to add each dependency using its canonical URL, hosted at some server like github. After adding the dependencies, you can use edit feature to put a dependency in Top of Tree mode. To do so, run:
>>> 
>>> $ swift package edit <PackageName> --path ../path/to/self/managed/checkout/of/the/package
>> 
>> Yes, this is what I tried this week. I’m pretty sure this is not a case of misunderstanding the feature or the docs.
>> 
> 
> Ah, cool!
> 
>>> 
>>> The package manager will then stop using the cloned repository and use the checkout present at that path (regardless of the state it is in).
>> 
>> Yes, but then I have – per dependency – two checkouts of a potentially huge repository. Why force everyone on the dev team to clone a huge repo twice, only to *never* use one of the clones.
> 
> Sure, you could end up with clones but that is only an implementation detail. SwiftPM can become smart enough and remove a clone that is not being used.
> 
>> Also, SwiftPM breaks when —path points at Packages/PackageName, which is exactly where I’d expect the package to be, not in some arbitrary external path (+ some kind of internal checkout cache that will never be used) as well.
> 
> If --path Packages/PackageName doesn't work, that is a bug! Do you mind filing a JIRA at bugs.swift.org <http://bugs.swift.org/>? 

SwiftPM in this case tries to make a symlink from Packages/PackageName -> Packages/PackageName and doesn’t allow continuing from there.

> 
> I understand internal caches could be an inconvenience if repositories are large but we can definitely improve how caching works.

It just seems unnecessary. Imagine (as an extreme example) you pull in the apple/swift repo as a dependency, with all its tens of thousands of commits, then you have a git submodule also in the repo with the same dependency. I’d just expect SwiftPM not to clone the package at all if I tell it I want it locally.

> 
>> 
>> I haven’t tried to test this recently because it’s a slow process but I have the impression the deps could be even be cloned more than twice, depending on how cleverly SwiftPM realises that multiple Packages have the same dependency.
> 
> Right now, SwiftPM will never clone a dependency twice.

Ok good to know. (Edit: this appears to be untrue, see below)

> 
>> Also, this makes managing interdependent state of development amongst dependencies more difficult than needed. How do we guarantee that devs are on the same commit when using top of tree development? Tagging and managing version numbers etc for day-to-day development is emphatically not an option for us.
> 
> When you use top of the tree mode, the checkout is expected to be managed by the user. That is exactly what top of the tree mode means. If we get local package support in the manifest, you will still need to manage the checkout state of those dependencies.

Yes, that is what I’m after: managing checkout state of dependencies ourselves.

> 
>> Since SwiftPM packages only work from a git context anyway, why not allow use of git’s established pattern of dealing with this, namely submodules?
> 
> I am not what do you mean here exactly.

I think my sentiments here are covered by the multi package repo proposal, thanks!

> 
>> 
>>> Sharing this setup is not automatic, but simple. Each user just needs to run the above command once per dependency.
>> 
>> We have about 10 dependencies, all of which will always be in this state. This seems like a lot of overhead and room for user error, plus it’s a huge workaround for something that could be very simple.
>> 
>>> Also, you only need to do this if you're actively working on a dependency. 
>> 
>> The point is that we will always be working on the dependencies. This is the core of what we’re doing, not a short aside. This is what makes me think we are either doing something wrong, or there is a big feature gap (as it appears from here).
> 
> I agree that a local dependency feature will be very helpful here but also note that you only need to run the edit command once (unless you delete the build folder). You can write a simple script that just put every dependency you have in edit mode.

Yes, this is manageable, if it works. It still feels like a 2nd or 3rd class citizen though, and a workaround / hack for something that seems like what I would have expected to be base case.

It seems like SwiftPM is based on a git workflow as its core element which appears to complicate things. This process of running an arbitrary script after running "git pull" is also just one more thing that needs doing (and is another source of human error). It also requires a working tag for each of those repos to clone from to "get started", which to me is an unnecessary requirement that again comes with lots of unnecessary cognitive load.

This also appears to just not work with our nested dependency structure. See below.

> 
>>> The new manifest also supports using branch instead of version range, which is very helpful during the development period.
>> 
>> This has much the same result as top-of-tree development, but it is how we were able to "hack" SwiftPM 3 into leaving us alone.
>> 
>>> Let me know if something is unclear or if you have more questions!
>> 
>> Maybe an overview of our structure would be helpful to make our use case clearer:
>> 
>> Main Project (git repo, not a Swift Package, contains no swift code directly)
>> –– Dependencies (external)
>> –– Subproject (internal git submodule, is a Swift Package, has multiple Swift Targets)
>> –––– Dependency A (internal, git submodule)
>> –––––––– Huge external C-language dependencies (managed via git submodules)
>> –––– Dependency B (internal, git submodule)
>> –––––––– Depends on internal dependency D
>> –––– Dependency C (internal, git submodule)
>> –––––––– Depends on internal dependency A
>> –––––––– Depends on internal dependency B
>> –––––––– etc.
>> –––– Dependency D (internal, git submodule)
>> 
>> I think the friction is coming from the fact that we’d like to use SwiftPM just to build, rather than to manage our dependencies.
>> 
>> Again, this could be solved with a simple API addition in the manifest:
>> 
>> Package(
>>   …
>>   dependencies: [
>>     .package.local(named: "Dependency A")
>>     .package.local(named: "Dependency B")
>>     ...
>>   ]
>> )
>> 
>> 
>> At the end of the day it seems we can work around this by cloning the submodules at Project/Submodule instead of Project/Package/Submodule and then running swift package edit Submodule —path ./Submodule, just that this process would have to be manual for each new dev cloning the repo. And then we’d still have two checkouts of the same thing. Yes, this works, it just seems very inefficient and still hacky. And it’s very possible it'll break again with future SwiftPM versions.
> 
> I think we do allow editing a package that is inside another package as a submodule. If that doesn't work, do you mind filing a JIRA with a sample project setup?

I have just spent the last couple of hours trying to implement this "top of tree" workaround. The 1st level dependencies appear to work as expected (top of tree) but it appears the subdependencies (2nd / 3rd level nesting) are being lifted from the git checkout in .build and not the expected local one, leading to all sorts of weird build errors that I’m finding difficult to fit into my mental model of what is supposed to be happening. 

Also, if I try to package edit DepWithHugeSubDep —path XYZ from within one of the dependencies then SwiftPM will clone it a third time, because DepWithHugeSubDep then tries to create its own .build context. I’m trying this now to see if it fixes the other issues we were having but I’m not sure it’ll work either.

> 
>> I’m just surprised the idea of a "local dependency" is not seen as a first class citizen in SwiftPM, still trying to understand the logic behind that. Maybe you can give me an idea of the reasoning behind this?
> 
> I understand your usecase will benefit a lot from the local dependency feature. We did consider adding this feature, I think the main concern was package authors ending up publishing package which only works for them incase they forget updating their manifest before a release. Also, note that SwiftPM is still under heavy development and we can definitely re-consider adding this!

Whether a subdependency exists seems like a pretty simple thing for SwiftPM to check for after loading a Package from the network. Surely a warning here would suffice - the package maintainer gets bombarded by emails and pays more attention next time. This doesn’t seem any more or less likely than package maintainers introducing any other kind of bug in packages they release.

> Also, I think this is a good usecase of a multipackage repository feature. We don't have that yet but you can read some of the discussion here <https://lists.swift.org/pipermail/swift-build-dev/Week-of-Mon-20161107/000722.html>.

This is excellent, in particular this:

let package = Package(
    dependencies: [
        .Package(subpackage: "Foo")
    ])
which is exactly what we need.

> 
> PS: We also have a slack channel if you want to hang out - https://lists.swift.org/pipermail/swift-build-dev/Week-of-Mon-20160530/000497.html <https://lists.swift.org/pipermail/swift-build-dev/Week-of-Mon-20160530/000497.html>
Thanks, I’ll check it out!

> 
>> Best Regards,
>> Geordie
>> 
>>>  
>>> Best Regards,
>>> Geordie
>>> 
>>> 
>>> PS. In SwiftPM 3 we had been using a hack that worked great: by filling in the dependencies' "basedOn" key in `workspace-state.json`, SwiftPM just left us alone.. We were able to commit `workspace-state.json` into our base project’s git repo and the rest Just Worked™. Now with the absolute paths being checked for this doesn’t seem to be an option.
>>> 
>>> 
>>> Please do not rely on internals of the package manager as they're not stable and will change without notice.
>> 
>> This was not our preferred way of going about it of course. But it was (unfortunately) the best solution to the problem.
>> 
>>> 
>>>  
>>> _______________________________________________
>>> swift-users mailing list
>>> swift-users at swift.org <mailto:swift-users at swift.org>
>>> https://lists.swift.org/mailman/listinfo/swift-users <https://lists.swift.org/mailman/listinfo/swift-users>
>>> 
>>> 
>>> _______________________________________________
>>> swift-users mailing list
>>> swift-users at swift.org <mailto:swift-users at swift.org>
>>> https://lists.swift.org/mailman/listinfo/swift-users <https://lists.swift.org/mailman/listinfo/swift-users>
>> 
> 
> 
> --
> Ankit
> 
> _______________________________________________
> swift-users mailing list
> swift-users at swift.org <mailto:swift-users at swift.org>
> https://lists.swift.org/mailman/listinfo/swift-users <https://lists.swift.org/mailman/listinfo/swift-users>

Cheers,
Geordie
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.swift.org/pipermail/swift-users/attachments/20170721/02bdfbfa/attachment.html>

More information about the swift-users mailing list