.NET Dependency Management with Paket Pedro Félix @pmhsfelix Lisbon, June 24, 2017 70ª Reunião Presencial da Comunidade NetPonto em Lisboa 

whoami • Professor at the Lisbon Polytechnic Institute – ISEL • Principal Software Engineer role at Sky • Concurrent programming, HTTP APIs, Identity and Access Management • Designing Evolvable Web APIs with ASP.NET, O’Reilly, 2014 See http://webapibook.net/ - freely available in HTML format 

Motivation • Large .NET solution • Multiple deployable projects (HTTP APIs, services, tools) • > 3 years old • Constantly changing dependencies 

Motivation • Versioning conflicts • Large commit diff. when a dependency changes • Lack of predictability • Lack of visibility • Runtime issues • Slowness • “Death by a thousand cuts” 

Alternatives • Paket - https://fsprojects.github.io/Paket/ • Open Source • F# • A full replacement for NuGet? • How does it relates to NuGet? • What are the improvements? • Visual Studio integration? 

Dependency Management assembly (name, version, deps) 

Dependency Management assembly (name, version, deps) .csproj 

Dependency Management assembly (name, version, deps) .csproj manually managed Ad-hoc server build instructions Assembly Source 

(name, version, deps) package Dependency Management assembly (name, version, deps) .csproj 

(name, version, deps) package (name, version, deps) package (name, version, deps) package (name, version, deps) package Dependency Management assembly (name, version, deps) .csproj NugGet Server (name, version, deps) package 

(name, version, deps) package (name, version, deps) package (name, version, deps) package (name, version, deps) package Dependency Management assembly (name, version, deps) .csproj nuget NuGet Server (name, version, deps) package query & fetch protocol 

(name, version, deps) package (name, version, deps) package (name, version, deps) package (name, version, deps) package Dependency Management assembly (name, version, deps) .csproj nuget NuGet Server (name, version, deps) package query & fetch protocol 

(name, version, deps) package (name, version, deps) package (name, version, deps) package (name, version, deps) package Dependency Management assembly (name, version, deps) .csproj nuget NuGet Server (name, version, deps) package query & fetch protocol  not in source control 

(name, version, deps) package (name, version, deps) package (name, version, deps) package (name, version, deps) package Dependency Management assembly (name, version, deps) .csproj nuget NuGet Server (name, version, deps) package query & fetch protocol packages .config  in source control  not in source control 

(name, version, deps) package (name, version, deps) package (name, version, deps) package (name, version, deps) package Dependency Management assembly (name, version, deps) .csproj nuget NuGet Server (name, version, deps) package query & fetch protocol packages .config per project  in source control  not in source control restore info per-project flat 

NuGet problems • packages.config is per project • Different versions for the same dependency on the same solution • packages.config is flat • Was a dependency directly or indirectly required? • Why was that version required? • No global view of the dependencies • Package/lib folder contains version number • Potential merge conflict on all .csproj and packages.config • Need to change any script that references the package/lib 

Dependency graph 

(name, version, deps) package (name, version, deps) package (name, version, deps) package (name, version, deps) package Dependency Management assembly (name, version, deps) .csproj nuget NuGet Server (name, version, deps) package query & fetch protocol packages .config per project  in source control  not in source control restore info per-project flat 

(name, version, deps) package (name, version, deps) package (name, version, deps) package (name, version, deps) package Dependency Management assembly (name, version, deps) .csproj paket NuGet Server (name, version, deps) package query & fetch protocol per project  not in source control paket .dependencies root deps version criteria per solution 

(name, version, deps) package (name, version, deps) package (name, version, deps) package (name, version, deps) package Dependency Management assembly (name, version, deps) .csproj paket NuGet Server (name, version, deps) package query & fetch protocol per project  not in source control paket .dependencies root deps version criteria per solution paket .references per project 

(name, version, deps) package (name, version, deps) package (name, version, deps) package (name, version, deps) package Dependency Management assembly (name, version, deps) .csproj paket NuGet Server (name, version, deps) package query & fetch protocol per project  not in source control paket .dependencies root deps version criteria per solution paket .references per project paket .lock dependency graph paket generated 

(name, version, deps) package (name, version, deps) package (name, version, deps) package (name, version, deps) package Dependency Management assembly (name, version, deps) .csproj paket NuGet Server (name, version, deps) package query & fetch protocol per project  not in source control paket .dependencies root deps version criteria per solution paket .references per project paket .lock dependency graph paket generated  source control  source control  source control 

paket • paket.dependencies – solution scope • Simple text format • Dependency sources • Dependencies and their version criteria • paket.references – project scope • Simple text format • References the used dependencies by name • paket.lock – solution scope • Simple text format • Generated by paket with the complete dependency graph • Source for the restore process 

DEMO TIME 

Final remarks • Commands • install, restore, ... • Binding redirect management • Simple text formats • paket.lock • Restore determinism • Dependency visibility 

Final remarks • Supports multiple Nuget servers • Other sources other than NuGet: HTTP and GitHub • Embrace the command line and simple text formats • Emphasis on dependency management • And just not simply downloading and referencing • Global view of the dependencies • Version control friendly • Less file changes • More informative changes 

Q&A 

Patrocinadores “GOLD” Twitter: @PTMicrosoft http://www.microsoft.com/portugal 

Patrocinadores “Silver” 

Patrocinadores “Bronze” 

http://bit.ly/netponto-aval-70 * Para quem não puder preencher durante a reunião, iremos enviar um email com o link à tarde 

Próximas reuniões presenciais 26/06/2017 – Lisboa 01/07/2017 – Porto 29/07/2017 – Lisboa 23/09/2017 – Lisboa 30/09/2017 – Leiria Reserva estes dias na agenda! :)