Paco - The tiny package manager (store.godotengine.org)

submitted 4 days ago* (last edited 4 days ago) by sunbytes@programming.dev to c/godot@programming.dev

20 comments fedilink hide all child comments

Paco is a free tiny package manager that provides a safer way to manage dependencies by downloading and installing packages from a trusted and predefined array rather than shipping addons and / or binaries directly with the project.

It's pretty much like Python, Go, or Ruby, where project dependencies can be installed from a list of packages and versions.

We’d love to get any feedback on this and know what you'd like to see improved

Thanks! 👋

all 24 comments

sorted by: hot top new old

[-] cheat700000007@lemmy.world 2 points 3 days ago

Hehe. Tiny package.

[-] jerkface@lemmy.ca 1 points 1 day ago

It's considered more sophisticated and refined.

[-] copygirl@lemmy.blahaj.zone 7 points 4 days ago* (last edited 4 days ago)

I honestly prefer git submodules, but not every addon provides a readily cloneable repo (or branch).

What prevents bad actors from changing stuff under the hood? Pinning specific versions and verifying via checksum could be helpful here.

[-] sunbytes@programming.dev 1 points 4 days ago* (last edited 4 days ago)

What prevents bad actors from changing stuff under the hood?

You'd have to hack into the asset store and upload another zip archive there to update the official registry, I guess 😄

verifying via checksum could be helpful here

Indeed, lock files and checksums are planned
It's still in early development and if you can help with any of this please suggest changes on the repo

Also if you're into decentralization you can own your manifest

[-] copygirl@lemmy.blahaj.zone 4 points 3 days ago* (last edited 3 days ago)

I don't know how the official asset store works, but some software repositories allow re-uploading binaries under the same version, often for a legitimate reason. Relatedly, for example, Vintage Story released the same version twice for Linux, because the first time it had a broken install script. Everything else stayed the same. It broke the AUR package though and required a pkgrel bump.

A bug in the asset store could be exploited or it could be hacked, a popular asset silently replaced, and then you won't know if something changed. You mentioned decentralization, but if you wanna support other unofficial sources, then again you need to either trust them (and their security), or you could have a verification check like I mentioned.

[-] sunbytes@programming.dev 3 points 3 days ago

Absolutely, there are preliminary work on package integrity verification it's simply non-food paying work as you can imagine but it will be committed anytime soon.
I know lock files are done by now, it will just take few more changes to have package integrity verification aswell.
We just didn’t expect people to want a full-featured package manager right away, but it’s going to happen.
Thank you for these wise advices, and again, you're more than welcome to join if you find time!

[-] copygirl@lemmy.blahaj.zone 1 points 3 days ago

Like pikl said, you made claims, so you can't just go "oh those don't matter because I'm not being paid". I wasn't demanding anything, I was just wondering if the claims held up. I'm just as much a hobby dev as you (by choice, in my case). We won't be able to do everything, satisfy everyone, finish every project, whatever it might be... but we can accept feedback all the same. And I'm glad you're considering mine.

[-] sunbytes@programming.dev 1 points 3 days ago

[removed by mod]

[-] copygirl@lemmy.blahaj.zone 4 points 3 days ago* (last edited 3 days ago)

You can do whatever you want, but another person can use their free will to point out incorrect claims. In fact, in the age of disinformation, it's pretty important to look into claims (say, about safety and performance) made by people and projects, because they're not always to be trusted.

If you really want to get into it, since you are already trusting the author of the project you're pulling code from, you don't gain any security from pulling part of the code from another source. The benefit of your package manager is having to include less code in your git repository, potentially making it smaller, and (presumably) the ease of updating to a newer version.

And I don't know how you went from reading my comment to "screw yourself". Perhaps you should reconsider the way you handle entirely neutral and well-meant feedback.

[-] sunbytes@programming.dev 2 points 2 days ago* (last edited 2 days ago)

It just wasn't my day, and we put a lot of effort into it, so being told that I said it does not matter kind of set me off a bit.
Anyway, lock files and package integrity verification have been pushed, there may still be a few details to iron out, but it seems to be working so far. Let me know if you find something that looks wrong or if you think about anything that is missing.

[-] RelativityRanger@jlai.lu 1 points 3 days ago

You just pointed behaviors that never happened, like OP never said it does not matter. I can understand why that might be annoying so I wouldn't call that neutral and well-meant feedback compared to your previous replies.

[-] copygirl@lemmy.blahaj.zone 2 points 3 days ago* (last edited 3 days ago)

In my second reply I pointed out why even the asset store is not a source you can blindly trust. In my third reply I meant to point out that deflecting with the project being free software is largely irrelevant, not to mention that OP asked for feedback. The "doesn't matter" part was pulled out of thin air, I'll admit, but it was based on the dismissive reply to pikl ("It’s free software mate lol").

[-] RelativityRanger@jlai.lu 1 points 3 days ago

In my second reply I pointed out why even the asset store is not a source you can blindly trust.

We all agree on this, the engine does exactly this, do no click the "asset store" tab tho. Never download anything from it, could be insecure. You see what I mean?

In my third reply I meant to point out that deflecting with the project being free software is largely irrelevant, not to mention that OP asked for feedback.

OP accepted all relevant feedback from what I can read in this thread. What pikl wrote never happened, so same story to me.
There are still a few things missing from the project, but it does not look like a big deal, and I'd really like to see it finished.

[-] copygirl@lemmy.blahaj.zone 2 points 3 days ago* (last edited 3 days ago)

The point is not that pulling any project from the asset store is insecure. It is for any code you download onto your computer that can execute arbitrary code. (In fact, yeah, the asset store itself could be dangerous, as it encourages people to download a package without first being able to inspect it. Again, I personally prefer pulling from a repo, which I can check out beforehand.)

The point is that a bad actor might be able to put themselves between your repository and the exact package version you're attempting to download, and give you something you did not expect. The checksum helps ensure that what you're getting was not tampered with, whether it by a man-in-the-middle, a hacker of the asset store, a hacker of the asset owner's account, or a malicious asset owner.

OP accepted the feedback, but they appeared to be.. let's say "more emotional" than others in this thread.

But hey, I appreciate you looking out for OP. They don't deserve to be piled on. I'm just trying to explain why I said what I said.

[-] RelativityRanger@jlai.lu 2 points 3 days ago* (last edited 3 days ago)

The point is that a bad actor might be able to put themselves between your repository and the exact package version you’re attempting to download

Everyone agree on this too and OP clearly mentionned checksums after you suggested a check and that's what should be implemented so that looks pretty fine too me. I like good endings :)

[-] x_pikl_x@lemmy.world 2 points 3 days ago

So you're selling it as a secure option, but the only question anyone has asked about security you say I don't know, laugh and change the subject. Immediately moving on.

[-] RelativityRanger@jlai.lu 3 points 3 days ago

you say I don’t know, laugh and change the subject. Immediately moving on.

Where? I read a suggestion that one could hack the official registry and that's exactly one of the point that @copygirl@lemmy.blahaj.zone raised afterwards

Then OP just says lock files and checksums are planned, can't you read?

[-] sunbytes@programming.dev 2 points 3 days ago* (last edited 3 days ago)

Selling? It's free software mate lol
No addon depends on each other yet, we're fine we got plenty of time to fix a week old projet
If you want to stand out, you can do so here and just so you know, commits are coming 😘

[-] RelativityRanger@jlai.lu 2 points 3 days ago

Don’t let yourself be put off by negative comments people might make, keep up the good work on this, it's a great start

[-] altphoto@lemmy.today 1 points 3 days ago

So PTTPM?

[-] cally@piefed.blahaj.zone 3 points 4 days ago

Cool! I don't have projects with dependencies right now but I'll check back on this if I do, I imagine it's useful for uploading to git hosting platforms without including a bunch of extra stuff that can be downloaded from the Godot store instead

this post was submitted on 31 Aug 2026

48 points (96.2% liked)

Godot

7868 readers

1 users here now

Welcome to the programming.dev Godot community!

This is a place where you can discuss about anything relating to the Godot game engine. Feel free to ask questions, post tutorials, show off your godot game, etc.

Make sure to follow the Godot CoC while chatting

We have a matrix room that can be used for chatting with other members of the community here

Other Communities

Rules

Posts need to be in english
Posts with explicit content must be tagged with nsfw
We do not condone harassment inside the community as well as trolling or equivalent behaviour
Do not post illegal materials or post things encouraging actions such as pirating games

We have a four strike system in this community where you get warned the first time you break a rule, then given a week ban, then given a year ban, then a permanent ban. Certain actions may bypass this and go straight to permanent ban if severe enough and done with malicious intent

Wormhole

!roguelikedev@programming.dev

Credits

The icon is a modified version of the official godot engine logo (changing the colors to a gradient and black background)
The banner is from Godot Design

founded 3 years ago

MODERATORS

snowe@programming.dev

Ategon@programming.dev

Feyter@programming.dev

Godot

Links

Other Communities

Rules

Wormhole

Credits