Package managers à la carte: A Formal Model of Dependency Resolution

Package managers are legion. Every language and operating system has its own solution, each with subtly different semantics for dependency resolution. This fragmentation prevents multi-lingual projects expressing precise dependencies across language ecosystems, means external system and hardware dependencies are implicit and unversioned, and obscures security vulnerabilities that lie in the full dependency graph. We present the Package Calculus, a formalism for dependency resolution that unifies the core semantics of diverse package managers. Through a series of formal reductions, we show how real-world package manager features reduce to our core calculus. We define the language Pac to translate between distinct package managers and show we can perform dependency resolution across ecosystems.

Get in touch at https://ryan.freumh.org/about.html

See the slides at https://ryan.freumh.org/talks/slides/2026-fosdem-pac.html