From mboxrd@z Thu Jan 1 00:00:00 1970 From: Jan Nieuwenhuizen Subject: Re: NPM and trusted binaries Date: Thu, 08 Sep 2016 21:54:36 +0200 Message-ID: <877famw4jn.fsf@gnu.org> References: <87shtiz8f7.fsf@gnu.org> <877farzrdl.fsf@gnu.org> <20160906165048.GC18454@thebird.nl> <87bmzzkt2d.fsf@gnu.org> <87eg4uwzi2.fsf@gnu.org> <87y432jo2b.fsf@gnu.org> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:37253) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bi5Pd-0004NS-GT for guix-devel@gnu.org; Thu, 08 Sep 2016 15:55:06 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1bi5PY-0007Iz-7w for guix-devel@gnu.org; Thu, 08 Sep 2016 15:55:04 -0400 In-Reply-To: <87y432jo2b.fsf@gnu.org> (Mike Gerwitz's message of "Thu, 08 Sep 2016 13:31:24 -0400") List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: Mike Gerwitz Cc: guix-devel Mike Gerwitz writes: > On Thu, Sep 08, 2016 at 10:45:57 +0200, Jan Nieuwenhuizen wrote: >> If a user builds an npm package from its source repository, I assume >> that they install the devDependencies needed for that using npm? > > Unfortunately that depends on the project. Some projects use > devDependencies only for things like linters, test runners, assertion > systems, etc; others might need them for building. The question I'm trying to answer is: how does `a user' who builds a package from the repository install the needed dependencies. I very much doubt that users install the essential dependencies all by building those from the source repository. How would they do that? My working hypothesis is that it's impossible to do so for any moderately interesting npm package. And I would very much like someone to show me (with working code) that instead it is possible. >> The transitive closure of installing all devDependencies for the `q' >> package by building them all from their source repositories, means >> building > 6000 packages. > > Many of those packages are shared between others. Not so. The total sum of interrelated dependencies to build `q' is over 41,000. The number of imported packages for `q' using Jelle's importer with some small fixes by me is over 6,000 unique dependencies and over 500 that can currently not be resolved by the importer and error out. Please show me that building `q' this way is possible and what the benefits are (in terms of software freedom) of spending our energy by upholding the source/binary metaphor (even if for a majority of packages there may not be a difference). Greetings, Jan --=20 Jan Nieuwenhuizen | GNU LilyPond http://lilypond.org Freelance IT http://JoyofSource.com | Avatar=C2=AE http://AvatarAcademy.nl= =20=20