17 hours ago
- Zig's package manager is integrated into the compiler, uses build.zig.zon for dependency declarations with content-addressed hashes, and no central registry.
- Dependencies are pinned by exact content hash, ensuring reproducibility but requiring manual updates for transitive fixes.
- The build system is Turing-complete (build.zig), allowing arbitrary code execution at build time, which fails the Tuesday test.
- Governance is minimal: the Zig Software Foundation manages the tool but not package hosting, leaving namespace and availability to source hosts like GitHub.
- The tool's own supply chain has zero external dependencies, with networking code shipped as source for easier patching.
- Unique features include a self-generated fingerprint for package identity independent of URL, and a --fork flag for transient override without manifest changes.