LoginSign Up
← Back to all sparks
M

Mamba

DEVOPS
Velocity5.0

Fast reimplementation of the conda package manager in C++

mamba.readthedocs.io ↗

Mamba is adding the reproducibility controls conda users have been asking of the solver.

package managementconda ecosystemreproducible solvessupply chainrelease candidates
◆Current state
The 2.9.0 release candidates introduce two user-facing controls: excluding builds newer than a given timestamp with --exclude-newer, and opting out of link script execution. Around them sit fixes with an operational bent, leaving permissions on shared package cache directories alone, explaining missing packages when string ids collide with solvables, and static linking corrections. The earlier alpha in this window is entirely bug fixes to noarch Python entry point linking and root package expansion.
◆Where it's heading
Both new options point the same way: making an environment solve predictable and less trusting. A timestamp cutoff turns a solve into something reproducible after the fact, and disabling link scripts removes arbitrary code execution from installation. The bug fixes concentrate on shared and multi-user installs, which suggests the pressure is coming from environments where one package cache serves many users.
◆Prediction
With a timestamp cutoff and a link-script opt-out both landing in the same release, the direction is toward solves that can be audited and repeated; further work most likely continues on the shared-cache and permissions handling these fixes keep touching.

◆Recent moves

  1. 3d ago

    2.9.0-rc1: exclude-newer timestamps and link script opt-out

    Adds --exclude-newer for excluding recent builds by timestamp and an opt-out for link script execution, plus a clearer error when string ids collide with solvables. The timestamp flag is the one that changes how a solve can be reproduced.

    View source ↗
  2. 7d ago

    2.9.0-rc0: first candidate for the 2.9 feature set

    The first release candidate for 2.9.0, carrying the same enhancement list as rc1 five days later. A staging tag rather than separate work.

    View source ↗
  3. 2mo ago

    2.7.0-alpha0: noarch entry point and root expansion fixes

    A prerelease of bug fixes only: hardened noarch Python entry point linking, guarded root package expansion, and site-packages path handling. Nothing user-facing is added.

    View source ↗