If It Quacks Like a Package Manager

On an aside, the MVS (minimum version selection) is an interesting and understandable algorithm for dependency resolution. Started from Go, CUE uses it now too.

https://research.swtch.com/vgo-mvs

>"The quacking that catches my ear is when something develops a dependency graph: your package depends on a package that depends on a package, and now you need resolution algorithms, lockfiles, integrity verification, and some way to answer “what am I actually running and how did it get here?”

Several tools that started as plugin systems, CI runners, and chart templating tools have quietly grown transitive dependency trees. Now they walk like a package manager, quack like a package manager, and have all the problems that npm and Cargo and Bundler have spent years learning to manage, though most of them haven’t caught up on the solutions."

https://edolstra.github.io/pubs/phd-thesis.pdf

> If it has transitive execution, it’s a package manager

Not really.

Spreadsheets, programming language functions, database triggers.

To be more accurate, if it downloads artifacts transitively it is a package manager.