System package managers and language package managers are solving different problems that happen to overlap in the middle.

Lobsters is a community-driven platform for sharing and discussing links to articles, tutorials, and projects related to technology and programming. Readers can learn about a wide range of topics, from software development and system administration to cybersecurity and artificial intelligence. With user submissions, comments, and voting, Lobsters provides a platform for collaborative learning and knowledge sharing among technology enthusiasts.

Lobsters

System package managers (apt, dnf) and language package managers (pip, npm, cargo) evolved to solve different problems, creating friction where they overlap. C libraries sit in this gap: needed by language packages but managed by system tools, with no standard registry or cross-manager communication. This creates "phantom dependencies" where C libraries are bundled invisibly into packages without appearing in metadata. The author proposes building a symbol database to map binary dependencies across ecosystems, making these implicit relationships visible for security scanning, funding attribution, and accurate SBOMs. Tools like Conda and Nix attempt to bridge this divide, but the fundamental problem remains unsolved.

The C-Shaped Hole in Package Management