Wherein we talk with Wolf Vollprecht about his work on Conda Forge and Mamba and the upcoming Packaging-Con event that he's organizing. The Packaging Con 2021: Call for Presentations is open until 1st September 2021,14:00 (UTC) if you'd like to speak: https://pretalx.com/packagingcon-2021/cfpSpecial Guest: Wolf Vollprecht.Links:conda-forgeconda-forge on GitHubAnaconda.orgPackagingCon 2021PackagingCon 2021: Call for PresentationsPackage Management devroom FOSDEM 2018Wolf Vollprecht on GitHubWolf VollprechtWolf Vollprecht on TwitterQuantStackQuantStack on GitHub

Wherein Alex talks with Nils Adermann, the co-founder of Packagist and co-creator of Composer, about package management in PHP.Special Guest: Nils Adermann.

Wherein we discuss how package management works in Debian and the Reproducible Builds project with Chris Lamb, a director of both the Open Source Initiative and of Software in the Public Interest, previously the Debian Project Leader and a core developer on the Reproducible Builds project.Special Guest: Chris Lamb.

Wherein we discuss Conan, the C and C++ package manager with Diego Rodriguez-Losada as it reaches 1.0. We talk about what inspired the development of Conan, package management problems specific to C/C++ package management and the plans for the future. Note: This episode was recorded 9 months before it was published, so some details may be out of date.Special Guest: Diego Rodriguez-Losada.Links:ConanConan on GitHubBintrayBincraftersbiicodeJFrog XrayConan hits 1.0Cpplang SlackDiego's websiteDiego on TwitterDiego on GitHubSwampUP

Wherein we discuss Clojars, the clojure package manager registry and it's relationship to Maven with Daniel Compton. Special Guest: Daniel Compton.Links:ClojarsDatomicClojureMicrosoft Dynamics NAVC/AL programming languageMavenThe Manifest Episode 6: Maven with Brian FoxLeiningenBoot: build tooling for ClojurecljdocMaven Artifact ResolverOpenJDKGraalClojureScriptGoogle Closure CompilervgoGit Deps for ClojureDeps - Private Maven Repository HostingDaniel Compton's websiteDaniel Compton on GitHubDaniel Compton on TwitterClojars on GitHub

Wherein we chat with Todd Gamblin about Spack, the package manager for supercomputers. We talk the unique challenges that packaging for High-performance computing platforms bring to package management, whether you should mine bitcoins on super computers and what's planned for the future of spack.Special Guest: Todd Gamblin.Links:SpackSpack on GitHubSpack documentationLawrence Livermore National LaboratoryHigh-performance computering on WikipediaEasyBuildSpack white paperHow To Make Package Managers CryPubGrub: Next-Generation Version Solving – Natalie WeizenbaumTodd Gamblin on GitHubTodd Gamblin on TwitterTodd Gamblin on The Changelog

Wherein we discuss open source licensing and how that relates to software packaging with Kate Stewart, of Linux Foundation and SPDX.Special Guest: Kate Stewart.Links:Board support packageLTIBSoftware Package Data Exchange (SPDX)DEP5FreshmeatFOSSologyBlack DuckCompliance Basics for DevelopersChoose a LicenseFreeRTOSThe `React Patent License’ ControversySPDX on GitHublibrariesio/spdx: A SPDX license normalizerlibrariesio/license-compatibility: Check compatibility between different SPDX licensesFree Software FoundationFOSDEM 2018 - Legal and Policy Issues devroomHeather MeekerKyle MitchellLuis VillaOracle America, Inc. v. Google, Inc.Spdx-tech mailing listSpdx-legal mailing listKate Stewart on Twitter

Wherein we discuss typosquatting and other security matters with Adam Baldwin, of Lift security and the Node Security Platform. We cover what kind of exploits people are trying, speculate about how blockchains may well be the answer, and unsuccessfully attempt to start a turf war between various package managers. Special Guest: Adam Baldwin.Links:^Lift Securitynpm registryTypo.js on GitHub52% of All JavaScript npm Packages Could Have Been Hacked via Weak CredentialsHave I been pwned?Protect your npm account with two-factor authenticationTyposquatting programming language package managersShellshockDependency CIThe Update Frameworkpackage.communitycrossenv malware on the npm registryNode Security PlatformYarnAdam Baldwin on TwitterAdam Baldwin on GitHub

Wherein we discuss Cargo (the Rust package manager) and Crates.io (the Rust package registry) with Carol (Nichols || Goulding). We talk about the Rust language, the history of the project, the features that make Cargo the envy of all the other package managers, and the sustainability of the project.Special Guest: Carol (Nichols || Goulding).Links:FOSDEM Package Management Devroom CFPCrates.ioCargo on GitHub

Wherein we chat with Trishank Karthik Kuppusamy about The Update Framework, a security layer that lets package managers assure the veracity and integrity of their packages. We talk about how it grew out of the TOR Project, how it works, how Uptane is used for package management in cars (!), and what package maintainers can do to help their own security.Special Guest: Trishank Karthik Kuppusamy.Links:FOSDEM Package Management Devroom CFPThe Update FrameworkThe Update Framework on GitHub