Package

Package — dastur kodi, metadata va bog‘liq resurslarni birgalikda tashkil qilish yoki tarqatish birligi. Atama dasturlash tili modullari, dependency manager, operatsion tizim paketi va application distribution kontekstida ishlatiladi.

Package ichida source code, compiled binary, configuration, documentation, asset va dependency ma’lumoti bo‘lishi mumkin.

Til package’i

Dasturlash tilida package code’ni mantiqiy guruhlaydi.

U:

• module;
• class;
• function;
• public API;
• internal implementation

ni bir nom ostida birlashtiradi.

Package ba’zi tillarda directory structure bilan bog‘langan, boshqalarida manifest orqali belgilanadi.

Distribution package

Dependency manager registrydan yuklaydigan versionlangan artifact ham package deyiladi.

Misollar:

• source archive;
• compiled wheel;
• JAR;
• NuGet package;
• npm tarball;
• crate;
• container layer bilan bog‘liq artifact.

Registry package nomi va versiyasi bo‘yicha tarqatadi.

Manifest

Package manifest quyidagi ma’lumotlarni saqlaydi:

• nom;
• versiya;
• dependency;
• entry point;
• license;
• author;
• platform;
• build script;
• feature;
• checksum;
• minimal runtime.

Manifest formati ekotizimga bog‘liq.

Public API

Package qaysi symbol tashqariga eksport qilinishini belgilaydi.

Internal code package ichida erkin o‘zgarishi mumkin.

Public API downstream package’lar uchun contract.

Semantik versiyalash public API o‘zgarishiga qarab version oshiradi.

Package manager

Package manager:

• registrydan qidiradi;
• dependency graph tuzadi;
• mos versiya tanlaydi;
• package yuklaydi;
• integrity tekshiradi;
• install qiladi;
• lock file yaratadi;
• update va remove bajaradi.

System package manager va language package manager turli qatlamda ishlashi mumkin.

Registry

Registry package metadata va artifactlarni saqlaydi.

U:

• authentication;
• namespace;
• version;
• immutable release;
• checksum;
• signature;
• yanked yoki deprecated holat

ni boshqarishi mumkin.

Public va private registry birga ishlatilganda dependency confusion xavfi hisobga olinadi.

Package nomi

Package nomi registry namespace’ida noyob.

Scoped package organization yoki user prefixiga ega bo‘lishi mumkin.

Nom tanlashda:

• typo;
• case sensitivity;
• reserved name;
• existing package;
• namespace ownership

muhim.

Version

Bir package ko‘p release versiyasiga ega.

Dependency constraint:

>= 2.1
< 3.0
^2.4
~1.8

kabi bo‘lishi mumkin.

Constraint semantikasi package managerga bog‘liq.

Lock file

Manifest ruxsat etilgan version oralig‘ini, lock file esa aniq resolved versiyalarni saqlaydi.

Lock file:

• reproducible install;
• transitive dependency;
• checksum;
• source registry

ni qayd etadi.

Application va library uchun lock file siyosati ekotizimga qarab farq qiladi.

Transitive dependency

Package bevosita ishlatmagan, uning dependency’si ishlatadigan package transitive dependency.

U ham:

• security;
• license;
• version conflict;
• bundle hajmi

ga ta’sir qiladi.

Dependency graph faqat direct ro‘yxat bilan cheklanmaydi.

Binary package

Binary package oldindan compile qilingan artifact beradi.

Afzalliklari:

• install tez;
• compiler talab qilmaydi;
• build dependency kam.

Kamchiligi:

• target architecture va ABIga bog‘liq;
• turli platforma uchun alohida artifact;
• native library compatibility.

Source package

Source package target muhitda build qilinadi.

Afzalligi — platformaga mos compile.

Kamchiligi — toolchain, build vaqt va reproducibility talabi.

Build script untrusted code sifatida bajarilishi mumkin.

System package

Operatsion tizim package’i filelarni standard joyga o‘rnatadi.

Tarkib:

• executable;
• shared library;
• service unit;
• config;
• documentation;
• user/group script;
• dependency.

Package database qaysi fayl qaysi package’ga tegishli ekanini saqlaydi.

Install script

Package install yoki update paytida script bajarishi mumkin.

Vazifalar:

• config migration;
• cache update;
• user yaratish;
• service restart;
• database setup.

Script ko‘pincha yuqori huquqda ishlaydi. Supply-chain xavfi katta.

Package va module

Module kodni import qilish va compilation birligi bo‘lishi mumkin.

Package esa bir yoki bir nechta module’ni tashkil qiladi yoki tarqatadi.

Ba’zi tillarda atamalar deyarli bir xil, boshqalarida aniq farqli.

Package va library

Library qayta ishlatiladigan funksionallik.

Package esa libraryni tarqatish formati.

Bitta package:

• bir nechta library;
• CLI;
• asset;
• type declaration

berishi mumkin.

Monorepo

Bir repositoryda ko‘p package saqlanishi mumkin.

Workspace vositasi:

• local dependency;
• umumiy lock file;
• coordinated version;
• selective build;
• publish

ni boshqaradi.

Har package public release qilinishi shart emas.

Package signing

Artifact checksum tasodifiy buzilishni aniqlaydi.

Digital signature package publisherini tekshirishga yordam beradi.

Package manager:

• trusted key;
• transparency log;
• registry TLS;
• signature policy

dan foydalanishi mumkin.

Typosquatting

Hujumchi mashhur package nomiga o‘xshash nom yaratadi.

Masalan, bitta harf farqi.

Himoya:

• nomni aniq tekshirish;
• lock file;
• private registry policy;
• package allowlist;
• dependency scanning.

Dependency confusion

Ichki package nomi public registryda yuqoriroq version bilan chiqariladi. Resolver public variantni tanlasa zararli code o‘rnatiladi.

Registry priority, scoped namespace va explicit source muhim.

Deprecation va yanking

Package release deprecated deb belgilanishi mumkin.

Yanking yangi resolutionda versionni tanlamaslikka yordam beradi, ammo mavjud lock file bilan install davom etishi mumkin.

Release’ni mutlaqo o‘chirib tashlash reproducibilityni buzadi.

Diagnostika

Package muammosida:

• package nomi;
• registry;
• version constraint;
• lock file;
• checksum;
• platform tag;
• ABI;
• transitive dependency;
• install script;
• cache;
• authentication

tekshiriladi.

“Package topilmadi” nom, registry, access yoki platform artifact yo‘qligi sabab bo‘lishi mumkin.

Bog‘liq tushunchalar

Package manager, Registry, Manifest, Module, Library, Dependency, Lock file, Semantic versioning, Artifact, Supply chain