Paco - The tiny package manager (store.godotengine.org)

submitted 4 days ago* (last edited 4 days ago) by sunbytes@programming.dev to c/godot@programming.dev

20 comments fedilink hide all child comments

Paco is a free tiny package manager that provides a safer way to manage dependencies by downloading and installing packages from a trusted and predefined array rather than shipping addons and / or binaries directly with the project.

It's pretty much like Python, Go, or Ruby, where project dependencies can be installed from a list of packages and versions.

We’d love to get any feedback on this and know what you'd like to see improved

Thanks! 👋

you are viewing a single comment's thread
view the rest of the comments

[-] RelativityRanger@jlai.lu 2 points 3 days ago* (last edited 3 days ago)

The point is that a bad actor might be able to put themselves between your repository and the exact package version you’re attempting to download

Everyone agree on this too and OP clearly mentionned checksums after you suggested a check and that's what should be implemented so that looks pretty fine too me. I like good endings :)

this post was submitted on 31 Aug 2026

48 points (96.2% liked)

Godot

7868 readers

1 users here now

Welcome to the programming.dev Godot community!

This is a place where you can discuss about anything relating to the Godot game engine. Feel free to ask questions, post tutorials, show off your godot game, etc.

Make sure to follow the Godot CoC while chatting

We have a matrix room that can be used for chatting with other members of the community here

Other Communities

Rules

Posts need to be in english
Posts with explicit content must be tagged with nsfw
We do not condone harassment inside the community as well as trolling or equivalent behaviour
Do not post illegal materials or post things encouraging actions such as pirating games

We have a four strike system in this community where you get warned the first time you break a rule, then given a week ban, then given a year ban, then a permanent ban. Certain actions may bypass this and go straight to permanent ban if severe enough and done with malicious intent

Wormhole

!roguelikedev@programming.dev

Credits

The icon is a modified version of the official godot engine logo (changing the colors to a gradient and black background)
The banner is from Godot Design

founded 3 years ago

MODERATORS

snowe@programming.dev

Ategon@programming.dev

Feyter@programming.dev

Godot

Links

Other Communities

Rules

Wormhole

Credits