From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mp1 ([2001:41d0:8:6d80::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) by ms0.migadu.com with LMTPS id yHBgESdMvWHMEQAAgWs5BA (envelope-from ) for ; Sat, 18 Dec 2021 03:49:11 +0100 Received: from aspmx1.migadu.com ([2001:41d0:8:6d80::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) by mp1 with LMTPS id EMXrDCdMvWGfWQAAbx9fmQ (envelope-from ) for ; Sat, 18 Dec 2021 02:49:11 +0000 Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by aspmx1.migadu.com (Postfix) with ESMTPS id C9EE517B99 for ; Sat, 18 Dec 2021 03:49:10 +0100 (CET) Received: from localhost ([::1]:38138 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1myPmW-0002sb-Vl for larch@yhetil.org; Fri, 17 Dec 2021 21:49:08 -0500 Received: from eggs.gnu.org ([209.51.188.92]:51776) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1myPmQ-0002sR-M8 for guix-patches@gnu.org; Fri, 17 Dec 2021 21:49:02 -0500 Received: from debbugs.gnu.org ([209.51.188.43]:57681) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1myPmP-0004zC-RI for guix-patches@gnu.org; Fri, 17 Dec 2021 21:49:01 -0500 Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1myPmP-0001IS-K1 for guix-patches@gnu.org; Fri, 17 Dec 2021 21:49:01 -0500 X-Loop: help-debbugs@gnu.org Subject: [bug#51838] [PATCH v5 07/45] guix: node-build-system: Add #:absent-dependencies argument. Resent-From: Timothy Sample Original-Sender: "Debbugs-submit" Resent-CC: guix-patches@gnu.org Resent-Date: Sat, 18 Dec 2021 02:49:01 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 51838 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: Liliana Marie Prikler Cc: 51838@debbugs.gnu.org, Pierre Langlois , Jelle Licht , Philip McGrath Received: via spool by 51838-submit@debbugs.gnu.org id=B51838.16397957334968 (code B ref 51838); Sat, 18 Dec 2021 02:49:01 +0000 Received: (at 51838) by debbugs.gnu.org; 18 Dec 2021 02:48:53 +0000 Received: from localhost ([127.0.0.1]:40994 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1myPmH-0001I3-G1 for submit@debbugs.gnu.org; Fri, 17 Dec 2021 21:48:53 -0500 Received: from wout5-smtp.messagingengine.com ([64.147.123.21]:52349) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1myPmF-0001Hg-0Y for 51838@debbugs.gnu.org; Fri, 17 Dec 2021 21:48:52 -0500 Received: from compute4.internal (compute4.nyi.internal [10.202.2.44]) by mailout.west.internal (Postfix) with ESMTP id 703253200C6B; Fri, 17 Dec 2021 21:48:44 -0500 (EST) Received: from mailfrontend2 ([10.202.2.163]) by compute4.internal (MEProxy); Fri, 17 Dec 2021 21:48:44 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:content-transfer-encoding:content-type :date:from:in-reply-to:message-id:mime-version:references :subject:to:x-me-proxy:x-me-proxy:x-me-sender:x-me-sender :x-sasl-enc; s=fm1; bh=NXAWh92hIGDtihUKqL3FQLnKf/15r1zWypVmJk3/D jk=; b=OdkSESbBi8hwq6KQ8OG2IfKHSSUHei+ARF4KbJ858r8IcJtwQKZK/v31S 7XzjlJ280t1oLM7gqqbHxj3uSqeEUkZt27y4K4erCviVnyE8zyu+P9Lb3fV9proq cvxkOiULZI+jjE++8Qf4BC6l5qrmaweaDwKmUBtEfFiiSOdFxB+6optcsk4KDuBM P9fFKxlVBcpnAEASqfSGdXSYdv5Ol0+PzodK3JFevT4rYytZppE0r8JUexEYHVce Sfc33kEK7VlDxUDkVpMZEThSupoTzrvYjUub/UjmUUZ6gvTSQoAwWWT4RXJnJLNM NH991z2DBkmio4A8yD+/dav8aDpug== X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgedvuddrleejgdegvdcutefuodetggdotefrodftvf curfhrohhfihhlvgemucfhrghsthforghilhdpqfgfvfdpuffrtefokffrpgfnqfghnecu uegrihhlohhuthemuceftddtnecusecvtfgvtghiphhivghnthhsucdlqddutddtmdenuc fjughrpefhvffufhffjgfkfgggtgfgsehtqhertddtreejnecuhfhrohhmpefvihhmohht hhihucfurghmphhlvgcuoehsrghmphhlvghtsehnghihrhhordgtohhmqeenucggtffrrg htthgvrhhnpeeiudeuhfeggeelleevheegudfguefhieekffdtveeilefglefhvddtgfei heetgfenucevlhhushhtvghrufhiiigvpedtnecurfgrrhgrmhepmhgrihhlfhhrohhmpe hsrghmphhlvghtsehnghihrhhordgtohhm X-ME-Proxy: Received: by mail.messagingengine.com (Postfix) with ESMTPA; Fri, 17 Dec 2021 21:48:43 -0500 (EST) From: Timothy Sample References: <20211213060107.129223-1-philip@philipmcgrath.com> <20211217020325.520821-1-philip@philipmcgrath.com> <20211217020325.520821-8-philip@philipmcgrath.com> <87k0g36xp3.fsf@ngyro.com> Date: Fri, 17 Dec 2021 21:48:41 -0500 In-Reply-To: (Liliana Marie Prikler's message of "Fri, 17 Dec 2021 20:40:09 +0100") Message-ID: <871r2a7hme.fsf@ngyro.com> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/27.2 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list X-BeenThere: guix-patches@gnu.org List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-patches-bounces+larch=yhetil.org@gnu.org Sender: "Guix-patches" X-Migadu-Flow: FLOW_IN X-Migadu-Country: US ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=yhetil.org; s=key1; t=1639795750; h=from:from:sender:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding:resent-cc: resent-from:resent-sender:resent-message-id:in-reply-to:in-reply-to: references:references:list-id:list-help:list-unsubscribe: list-subscribe:list-post:dkim-signature; bh=NXAWh92hIGDtihUKqL3FQLnKf/15r1zWypVmJk3/Djk=; b=R1aR6s4SQE8YnvizgfE6JtDcCP13YT/GO5zBw+YZbTu8mC8a75X3GAPKPdCyVW6RhueQic tPBqWY1N64zxpysP3nl7VvT+oQWULJsm3VlMKKXu1ONrnmaKnrGAD2aUIGNZkNyI/dd/e+ mxRtaIzBj7qd264ovb2MU9gSuQe99+3mYsEiC3mEO+OxbLrZVCcvI39dmRgaZRQ4pfhDJ8 XrPV5i89zy3Sga4SowQ2/DzO/UdDQYGqyFTw/xTqNPWIk9y5B2+rHqi/iTeOkMiIDojMx+ mUL9qiyMzToZ40WdATdMeTNnmAnjTVzlxeqYcwabbP1wcRiG3P+eW9sokXyB2A== ARC-Seal: i=1; s=key1; d=yhetil.org; t=1639795750; a=rsa-sha256; cv=none; b=n3/lBUOKJ4+uMR3SiBIuKwiHfPUI1Iwki7cijDIvXrX0YNsiYW7CN6RWYR91KbBisqJZ/S LLrtgi1cX6nnthy4ER6+GSnu4UKZgQF4ePK/KwQc/LhqDbJpqDvSmVh3JPrDFFRbA5vTLu 5e0tpQFcL+L7zNATv+L+5qEYInDOrUb6ACs1xM75GhKXssGWA7lImPPtDlxI6XJJHgiKNG S4hdXpYERfcbQ5cZOtJyr6W4+QlYaL+P8FXyPGPjx9N7pj/ixHvYGcGRC+5P/rNtjM84xa xE8x4WqHJhrSw06eL6v3onGy3OYV/DxnW1SGKYOaSybvEHxI8nGpm3uL2JfdMw== ARC-Authentication-Results: i=1; aspmx1.migadu.com; dkim=fail ("headers rsa verify failed") header.d=messagingengine.com header.s=fm1 header.b=OdkSESbB; dmarc=none; spf=pass (aspmx1.migadu.com: domain of "guix-patches-bounces+larch=yhetil.org@gnu.org" designates 209.51.188.17 as permitted sender) smtp.mailfrom="guix-patches-bounces+larch=yhetil.org@gnu.org" X-Migadu-Spam-Score: -1.40 Authentication-Results: aspmx1.migadu.com; dkim=fail ("headers rsa verify failed") header.d=messagingengine.com header.s=fm1 header.b=OdkSESbB; dmarc=none; spf=pass (aspmx1.migadu.com: domain of "guix-patches-bounces+larch=yhetil.org@gnu.org" designates 209.51.188.17 as permitted sender) smtp.mailfrom="guix-patches-bounces+larch=yhetil.org@gnu.org" X-Migadu-Queue-Id: C9EE517B99 X-Spam-Score: -1.40 X-Migadu-Scanner: scn0.migadu.com X-TUID: ais84/DLB1RU Liliana Marie Prikler writes: > For the GNU build system (and likewise meson-build-system), the default > behaviour if you haven't specified anything as per upstream conventions > is typically to error if the package is required and omit it if it's > not. The default behaviour of node-build-system (and likewise cargo > and most other build systems that come with the advertisement of "we > know package managers better than people who actually produce useful > package managers) is "Oh my god, you don't have an exact copy of the > machine that built this stuff locally, I am going to barf huge walls of > noise at you". Therefore, we can't meaningfully compare those build > systems in terms of strategies. NPM packages tend to wildly over-specify their dependencies. We already remove dependency version checking, and before this change, many of our packages skipped any kind of dependency checking by skipping the configure phase altogether. To me, the =E2=80=98#:absent-dependencies=E2= =80=99 approach tries to work around the dependency over-specification by listing exactly those things that are only there to elicit a useless =E2=80=9COh my= god [...], I=E2=80=99m going to barf huge walls of noise=E2=80=9D message. The= rest of the dependencies are those that the Guix package author deemed required (or at least important). Basically, =E2=80=98#:absent-dependencies=E2=80=99 he= lps us translate between the NPM culture of over-specification (which is really a culture of prioritizing package author over package user) and the GNU culture of =E2=80=9CDWIM=E2=80=9D dependencies. > If we really want some static verification for node-build-system, I > think we should take that as an approach rather than hard-coding > (absent) dependencies literally everywhere. We need some way to know what to statically verify. We can=E2=80=99t magic= ally know what=E2=80=99s important and what isn=E2=80=99t. The two options in t= his thread are =E2=80=98#:absent-dependencies=E2=80=99, and only checking what=E2=80= =99s already in the package=E2=80=99s inputs. What worries me about the second approach is tha= t it offers no help when updating a package. With =E2=80=98#:absent-dependencie= s=E2=80=99, if the developer adds a new dependency that really is required, we will get a build-time failure letting us know. Whoever is updating the package can fix it before even committing anything. If we just check the inputs, that=E2=80=99s not the case, and we might end up with Philip=E2= =80=99s =E2=80=9Cmysterious runtime error, potentially many steps down a dependency chain.=E2=80=9D Hopefully tests would catch it, but I like the extra assur= ance. Another benefit is that it would help us gain knowledge as to which NPM packages are often used but not actually required (e.g., NPM publishing tools). With this knowledge, we could write a clever NPM importer that ignored obviously inessential dependencies. I guess I=E2=80=99m starting to sound like a broken record now =E2=80=93 th= is is basically what we covered before! :) Maybe we=E2=80=99re in need of a fre= sh perspective. (If anyone is reading along and has thoughts, feel free to chime in!) -- Tim