[bug#40860] [PATCH] yarnpkg

[bug#40860] [PATCH] yarnpkg

[Kozo]

[-- Attachment #1: Type: text/plain, Size: 215 bytes --]

Hello,

This is my first submission. Please let me know how I can improve for
future packages.

I followed the steps in the manual and submitted a Software Heritage
request to pull the source code.

Thank you,
Kozo

[-- Attachment #2: 0001-yarnpkg.patch --]
[-- Type: text/x-patch, Size: 2299 bytes --]

From cf6cecd960225bab04cc33041e42d4e0cf4a075c Mon Sep 17 00:00:00 2001
From: Kozodev <gitlabcanada@runbox.com>
Date: Sat, 25 Apr 2020 20:09:34 -0600
Subject: [PATCH] yarnpkg

---
 yarn.scm | 47 +++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 47 insertions(+)
 create mode 100644 yarn.scm

diff --git a/yarn.scm b/yarn.scm
new file mode 100644
index 0000000..4a1a57b
--- /dev/null
+++ b/yarn.scm
@@ -0,0 +1,47 @@
+(define-module (yarn)
+  #:use-module (guix packages)
+  #:use-module (guix download)
+  #:use-module (guix build-system trivial)
+  #:use-module (guix licenses)
+  #:use-module (gnu packages node)
+  #:use-module (ice-9 pretty-print))
+
+(define yarn-version "1.22.4")
+
+(define-public yarn
+  (package
+   (name "yarn")
+   (version yarn-version)
+   (source (origin
+    (method url-fetch/tarbomb)
+    (uri (string-append "https://github.com/yarnpkg/yarn/releases/download/v"
+     version "/yarn-v" version ".tar.gz"))
+    (sha256
+     (base32
+      "0n7vhwjz3lyjnavcaw08cqa8gfampqsy5mm3f555cbqb26m1clxw"))))
+   (build-system trivial-build-system)
+   (outputs '("out"))
+   (inputs `(("node" ,node)))
+   (arguments
+    `(#:modules ((guix build utils))
+      #:builder (begin
+  (use-modules (guix build utils))
+                  (let* ((out (assoc-ref %outputs "out"))
+   (bin (string-append  out "/bin"))
+   (lib (string-append  out "/lib"))
+                         (node-modules (string-append lib "/node_modules"))
+                         (yarn (string-append node-modules "/yarn"))
+                         (input-dir (string-append
+     (assoc-ref %build-inputs "source") "/yarn-v" ,version)))
+    (mkdir-p yarn)
+    (mkdir-p bin)
+    (copy-recursively (string-append input-dir "/") yarn)
+    (symlink (string-append yarn "/bin/yarn") (string-append bin "/yarn"))
+    (symlink (string-append yarn "/bin/yarnpkg") (string-append bin "/yarnpkg"))
+    (delete-file (string-append yarn "/bin/yarn.cmd"))
+    (delete-file (string-append yarn "/bin/yarnpkg.cmd"))))))
+   (home-page "https://yarnpkg.com/")
+   (synopsis "Dependency management tool for JavaScript")
+   (description "Fast, reliable, and secure dependency management tool
+for JavaScript.  Acts as a drop-in replacement for NodeJS's npm.")
+   (license bsd-2)))
-- 
2.26.2

[bug#40860] [PATCH] yarnpkg

[Christopher Baines]

[-- Attachment #1: Type: text/plain, Size: 1979 bytes --]


Kozo <Gitlabcanada@runbox.com> writes:

> This is my first submission. Please let me know how I can improve for
> future packages.
>
> I followed the steps in the manual and submitted a Software Heritage
> request to pull the source code.

Hi Kozo,

Yarn would indeed be something that would be nice to have a package for.

While I guess that this might work, I think there are issues with the
source here and the lack of dependencies that make this unsuitable for
Guix.

> +(define-public yarn
> +  (package
> +   (name "yarn")
> +   (version yarn-version)
> +   (source (origin
> +    (method url-fetch/tarbomb)
> +    (uri (string-append "https://github.com/yarnpkg/yarn/releases/download/v"
> +     version "/yarn-v" version ".tar.gz"))
> +    (sha256
> +     (base32
> +      "0n7vhwjz3lyjnavcaw08cqa8gfampqsy5mm3f555cbqb26m1clxw"))))

The key thing here is source. For many reasons, the packages in Guix
represent software being built from some source material.

What's being downloaded here might look like source material, but I
doubt the ~153,409 line lib/cli.js file is really the preferred form for
editing the Yarn source code.

> +   (build-system trivial-build-system)
> +   (outputs '("out"))
> +   (inputs `(("node" ,node)))

Another sign that something is up is the mismatch between the inputs
here, and the dependencies in the upstream metadata [1]. Assuming the
package works, I'm guessing that there's a lot more than the source of
Yarn within the "source" of this package.

1: https://github.com/yarnpkg/yarn/blob/master/package.json

I'm hopeful that package Yarn will become possible sometime soon, but in
my mind the path forward is to get an importer working for npm, package
the many dependencies, then attempt to package yarn.

Unfortunately I don't think there's a bug that tracks this overall issue
well, although I did find a similar bug about yarn [2]

2: https://debbugs.gnu.org/cgi/bugreport.cgi?bug=33431

Does that make sense?

Thanks,

Chris

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 962 bytes --]

[bug#40860] [PATCH] yarnpkg

[Jakub Kądziołka]

[-- Attachment #1: Type: text/plain, Size: 2373 bytes --]

On Sat, Apr 25, 2020 at 08:15:56PM -0600, Kozo wrote:
> Subject: [PATCH] yarnpkg
> 
> ---
>  yarn.scm | 47 +++++++++++++++++++++++++++++++++++++++++++++++
>  1 file changed, 47 insertions(+)
>  create mode 100644 yarn.scm

Please write commit logs in the ChangeLog format [0]. You can check the
commit history for examples.

> (define-module (yarn)

Please put the file in gnu/packages/. Also, add it to the list in
gnu/local.mk.

>   #:use-module (guix packages)
>   #:use-module (guix download)
>   #:use-module (guix build-system trivial)
>   #:use-module (guix licenses)
>   #:use-module (gnu packages node)
>   #:use-module (ice-9 pretty-print))

I can't see where (ice-9 pretty-print) is being used.

> (define yarn-version "1.22.4")

What is the purpose of this single-use variable?

> (define-public yarn
>   (package
>    (name "yarn")
>    (version yarn-version)
>    (source (origin
>     (method url-fetch/tarbomb)

The file has only a single directory, so why use /tarbomb?

>     (uri (string-append "https://github.com/yarnpkg/yarn/releases/download/v"
>      version "/yarn-v" version ".tar.gz"))

When looking through this download, it seems that the lib/cli.js file is
a preprocessed mess. Ideally, we would build the package from source.

>     (sha256
>      (base32
>       "0n7vhwjz3lyjnavcaw08cqa8gfampqsy5mm3f555cbqb26m1clxw"))))
>    (build-system trivial-build-system)
>    (outputs '("out"))
>    (inputs `(("node" ,node)))
>    (arguments
>     `(#:modules ((guix build utils))
>       #:builder (begin
>   (use-modules (guix build utils))
>                   (let* ((out (assoc-ref %outputs "out"))
>    (bin (string-append  out "/bin"))
>    (lib (string-append  out "/lib"))

The indentation is quite confusing here, I'd suggest running
./etc/format-code.el on your file.

>    (synopsis "Dependency management tool for JavaScript")
>    (description "Fast, reliable, and secure dependency management tool
> for JavaScript.  Acts as a drop-in replacement for NodeJS's npm.")

I think there are a lot of buzzwords in this description: "fast,
reliable and secure" is not an objective property. Is there something
more neutral that could be said about the package?

Thanks,
Jakub Kądziołka

[0]: https://www.gnu.org/prep/standards/html_node/Change-Logs.html#Change-Logs

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

[bug#40860] [PATCH] Yarnpkg

[Kozo]

Thank you for the feedback, Christopher and Jakub.

After going over what you said, this package is beyond my current
experience. It would make sense to start getting all the dependencies
in one at a time and return to this one later.

Please go ahead and close this request as I work on the building
blocks.

Thanks,
Kozo

bug#40860: [PATCH] Yarnpkg

[Björn Höfling]

[-- Attachment #1: Type: text/plain, Size: 754 bytes --]

On Mon, 27 Apr 2020 08:10:28 -0600
Kozo <Gitlabcanada@runbox.com> wrote:

> Thank you for the feedback, Christopher and Jakub.
> 
> After going over what you said, this package is beyond my current
> experience. It would make sense to start getting all the dependencies
> in one at a time and return to this one later.
> 
> Please go ahead and close this request as I work on the building
> blocks.

Hi Kozo,

you can close issues by appending "-done" to the bug-number as I did.

node/npm is terribly hard because of its "dependency hell". 

Jelle Licht worked on an npm-importer. AFAIK it is not yet part of
Guix. Here is a reference on it I found:

https://lists.gnu.org/archive/html/guix-devel/2017-03/msg00814.html

Björn


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[bug#40860] (no subject)

[Kozo via web]

Greetings,

Thank you for your feedback. This package is too complex for my current experience level.

The current plan of action will be to start getting all the dependencies added in and then come back to this overall package.

Please close this request and we'll re-visit it in the future.

Thank you,
Kozo

[bug#40860] (no subject)

[Björn Höfling]

[-- Attachment #1: Type: text/plain, Size: 551 bytes --]

On Mon,  4 May 2020 21:28:54 +0200
Kozo via web <issues.guix.gnu.org@elephly.net> wrote:

> Greetings,
> 
> Thank you for your feedback. This package is too complex for my
> current experience level.
> 
> The current plan of action will be to start getting all the
> dependencies added in and then come back to this overall package.
> 
> Please close this request and we'll re-visit it in the future.

Closed with adding "-done" to the bug-number.

Thanks for giving it a try and see you around with smaller packages
first.

Björn

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 195 bytes --]