Leaderboard

Accepted, moving on. Did you mean Web of trust - like OpenPGP? https://en.wikipedia.org/wiki/Web_of_trust - I can't imagine how that would work practically in a world wide scenario - we certainly wouldn't be meeting to present our public keys 🤔 In any event, it seems unnecessarily complex when simpler solutions to SPOF exist. Yes, and DPM is absolutely architected to facilitate that (see the second screenshot above). Yep - the source for the DPM website/server is here https://github.com/DelphiPackageManager/DPMGallery (f-react-ui branch) - and it would not be difficult to build/install onsite (though not documented yet). The rest api surface is relatively small (and still evolving) so it's quite conceivable someone could re-implement the server however they like - for example adding authenticated access for downloading packages. The package storage mechanism is abstracted with multiple implementations (Google, Amazon, Bunny.net and FileSystem) so you can choose where the actual package files live. I originally used S3 but that was expensive so moved to bunny.net which at the moment is only costing me $1 per month!

Since years, our Open Source mORMot framework offers several ways to work with any kind of runtime arrays/objects documents defined, e.g. via JSON, with a lot of features, and very high performance. Our TDocVariant custom variant type is a powerful way of working with such schema-less data, but it was found confusing by some users. So we developed a new set of interface definitions around it, to ease its usage, without sacrificing its power. We modelized them around Python Lists and Dictionaries, which is proven ground - with some extensions of course. Two one-liners may show how our mORMot library is quite unique in the forest/jungle of JSON libraries for Delphi (and FPC): +] assert(DocList('[{ab:1,cd:{ef:"two"}}]')[0].cd.ef = 'two'); assert(DocList('[{ab:1,cd:{ef:"two"}}]').First('ab<>0').cd.ef = 'two'); Yes, this code compiles and run on Delphi - even the antique Delphi 7. 😆 If you compare e.g. to how the standard JSON library works in the RTL, with all its per-node classes, you may find quite a difference! And there is no secret in regard to performance, that our JSON processing is fast. More info: https://blog.synopse.info/?post/2024/02/01/Easy-JSON-with-Delphi-and-FPC

The Drag and Drop Component Suite contains a demo application that can be used to diagnose a drop target (there's one for drop sources too, fwiw). You could use that to determine the exact interaction between the drop source and target. There is also a demo of WM_DROPFILES, including the handling of ChangeWindowMessageFilter*. The screenshot below shows the Drop Target Analyzer dropping CF_HDROP data (i.e. a file) onto the WM_DROPFILES demo, which is running elevated.

There is code for exactly that in David's answer on the StackOverflow post you linked to. If you are running your app (or the IDE) with elevated rights, then you also need to call ChangeWindowMessageFilter/Ex() to allow lesser-privileged processes, like File Explorer, to send WM_DROPFILES messages to your app.

Contructive critique is fine, sarcastic comments like "fixed it for you" is not at all helpful and frankly annoying. I have blogged, posted here and on other forums numerous times, created an RFC repo on github for feedback - but very little input was received and there no proposed distributed designs with any detail (let's use github and all our problems will be solved 🙄). I have been researching package managers for a long time. None are perfect, and dpm certainly isn't nore will it ever be, but it's a lot better than what we have now - getit is really not of any use (other than for installing delphi). I looked at the package managers for most of the major language/tool eco systems out there - and took ideas from all of them. None of the package managers I looked at are distrubuted - can you point to any that are? Distributed sound cool and all - but how do you ensure a) that the package has not been modified by anyone other than the author (Integrity) b) the package is actually from the author (Authenticity) c) that the package actually comes from where it says it does (Provenance). It's difficult enough to do with a central package server, doing so in a distrubuted system would be next to impossible (who is the source of the truth?). DPM does allow you to configure multiple package sources (as to most other package managers) - so you can easily download the package files (or just copy them from the package cache) to a network share and point dpm at that - in fact in some corporate enviroments this would be the only allowed scenario (I have seen this quite a bit with nuget) to avoid supply chain attacks and license issues.

For the Embarcadero Edition there seems to be only GetIt as a source, but you may try to contact their support.

I wasn't going to bring it up in this thread.. but since you opened the door... I've been working on one for a while now https://delphi.dev - but it's a big project for one person and I have a business to run and a family. Docs - https://docs.delphi.dev/ Source https://github.com/DelphiPackageManager Installer - https://github.com/DelphiPackageManager/DPM/releases (codesigned by VSoft Technologies Pty Ltd). It is working well, but I have yet to implement loading design time packages - the reason for that is a lack of spare time. I did redo the IDE user interface a while back and that part is much easier to use than before (modelled on Jetbrain's Rider nuget support) - I use it daily. DPM supports Delphi XE2 - 12.0 - which should make upgrading to newer delphi versions easy - if the packages you use are available for the newer version of delphi, just open your project in that new version (with dpm installed) and dpm will automatically download and install the packages required for the project (and update search paths accordingly). Packages can be hosted by a package server, or a directory (ie network file share). The website is also a package server - that part is working well, however the ui needs a lot more work so that users can create api keys for pubishing packages. Right now the only packages there are ones I forked and published. The website is an asp.net 8.0 application (because I have a lot of experience with it) with a react front end, using a postgresql db - running on ubuntu server on a vm on one of my servers in Sydney - not ideal for latency for the rest of the world - it is behind cloudfare but api routes are excluded (cloudfare does help as a cdn for the images and javascript). If interest in/usage of the server actually took off I would move it to a cloud host in the US to improve latency (that would require some funding). The actual package files are on a cdn (bunny.net) and are regionally cached, so once someone near you has downloaded a package it is cached on their edge and its fast to download. Right now that's not costing me much but if usage ramps up it would. I went with bunny.net purely because of pricing - but apart from the stupid name it's actually a pretty good service. Recently someone (thanks @Geoffrey Smith ) contributed a tool for creating dpm package definition files (json) and we have been working on that together (it's installed by default now). Geoff created this tool to ease creating package definitions for some commercial libraires he is using. I would love to see more interest in the project and welcome contributions.

It's incredible this is still down.