What Hatch does
- A parallel PubGrub resolver for packages from pub.dev.
- Strips files the build does not need out of packages and stores them in a machine-global cache shared by every project.
- Verifies SHA-256 checksums on every download.
- Pins the Flutter SDK version through FVM.
- Manifest scripts and a plugin system.
- The hatch-ios plugin, which works only partially so far, is meant to build, sign and upload an iOS app to TestFlight without a Mac.
Commands
- Project: init, migrate (from pubspec.yaml to hatch.json), install, add, remove, update, why and run for scripts.
- Tooling: fvm (list, use, install, sync), sdk-update, cache stats, cache prune and cache clear, plugin install, list and remove.
- Flags: -v to -vvv, -q, --profile, --project-dir and --allow-unchecksummed.
- The ios plugin: ios build --sign --upload.
Speed
Speed comes from five techniques: a manifest-hash cache, interval propagation that skips the full solve when dependencies are conflict-free, parallel metadata fetching, parallel solving of independent subgraphs, and PubGrub for the remainder. Benchmarks live in the benches/ directory of the repository.
Problems it solves
- Slow dependency resolution, through the parallel resolver and the cache.
- Bloated packages with example, test, doc and CI folders: Hatch strips them on extraction. This can be turned off with HATCH_DEBLOAT=0 or tuned per package in .hatch.json.
- Duplicate package copies in every project, through a shared cache that can be relocated with HATCH_CACHE_DIR.
- Version drift between machines and CI, through FVM, a lockfile and deterministic resolution.
- Unverified downloads and untrusted dependency scripts: mandatory SHA-256 and a trust prompt on first use, with CI denying scripts by default.
- Credentials outside the manifest: they are kept in a git-ignored hatch_auth.json or in HATCH_NEST_* variables.
Status
Hatch is published as version 0.2.0 under the MIT or Apache-2.0 licence. The source code and installers for Windows, macOS and Linux are on GitHub. Resolution from pub.dev, path dependencies, stripping unneeded files, cache management, checksums, FVM, migration and scripts work. The plugin registry, the Mac-free iOS build and profiles work partially. Git dependencies and a private registry are planned.
Technology
The tool is written in Rust and ships as a single static binary.
