From mboxrd@z Thu Jan 1 00:00:00 1970 From: swedebugia Subject: NPM importer - tarballs - SWH - commit ids Date: Wed, 28 Nov 2018 12:26:13 +0100 Message-ID: Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:42195) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1gRxtK-000241-RW for guix-devel@gnu.org; Wed, 28 Nov 2018 06:20:27 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1gRxtI-00067V-21 for guix-devel@gnu.org; Wed, 28 Nov 2018 06:20:26 -0500 Received: from mx1.riseup.net ([198.252.153.129]:60856) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1gRxtH-0005lz-RK for guix-devel@gnu.org; Wed, 28 Nov 2018 06:20:23 -0500 Received: from piha.riseup.net (piha-pn.riseup.net [10.0.1.163]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (Client CN "*.riseup.net", Issuer "COMODO RSA Domain Validation Secure Server CA" (verified OK)) by mx1.riseup.net (Postfix) with ESMTPS id C00361A0182 for ; Wed, 28 Nov 2018 03:20:11 -0800 (PST) Received: from [127.0.0.1] (localhost [127.0.0.1]) by piha.riseup.net with ESMTPSA id 2C2891F371E for ; Wed, 28 Nov 2018 03:20:10 -0800 (PST) Content-Language: en-US List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: guix-devel Hi I looked closer at the json output from npmregistry and found that they host tarballs and give the url for every version in the json response. ("tarball" . "url"). All the npm packages I ever looked at (100 or so of the biggest and dependencies of those) was hosted on Github. I have a few questions regarding the wealth of information available from this registry 1) Does anyone know if these tarballs are reproducible? ie do they change over time? 2) Can we use the gpg signature for something? 3) SWH gives us tarballs according to commit ids. If we use npm-tarballs we can store the commit in the json response (or look it up with the github api) as a property: (properties `((commit . hash))) Any thoughts? -- Cheers Swedebugia