From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mp1 ([2001:41d0:2:bcc0::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) by ms0.migadu.com with LMTPS id OGOkHwYrmWGH9AAAgWs5BA (envelope-from ) for ; Sat, 20 Nov 2021 18:06:14 +0100 Received: from aspmx1.migadu.com ([2001:41d0:2:bcc0::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) by mp1 with LMTPS id MF1cGwYrmWHCOAAAbx9fmQ (envelope-from ) for ; Sat, 20 Nov 2021 17:06:14 +0000 Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by aspmx1.migadu.com (Postfix) with ESMTPS id E4FD4C531 for ; Sat, 20 Nov 2021 18:06:13 +0100 (CET) Received: from localhost ([::1]:51900 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1moToa-0008HH-NY for larch@yhetil.org; Sat, 20 Nov 2021 12:06:12 -0500 Received: from eggs.gnu.org ([209.51.188.92]:59244) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1moTnU-0006tC-Pf for guix-patches@gnu.org; Sat, 20 Nov 2021 12:05:04 -0500 Received: from debbugs.gnu.org ([209.51.188.43]:60285) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1moTnU-0000NT-Dy for guix-patches@gnu.org; Sat, 20 Nov 2021 12:05:04 -0500 Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1moTnU-0003wB-90 for guix-patches@gnu.org; Sat, 20 Nov 2021 12:05:04 -0500 X-Loop: help-debbugs@gnu.org Subject: [bug#51838] [PATCH v2 05/26] guix: node-build-system: Add #:absent-dependencies argument. Resent-From: Philip McGrath Original-Sender: "Debbugs-submit" Resent-CC: guix-patches@gnu.org Resent-Date: Sat, 20 Nov 2021 17:05:04 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 51838 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: Liliana Marie Prikler , 51838@debbugs.gnu.org Received: via spool by 51838-submit@debbugs.gnu.org id=B51838.163742790215097 (code B ref 51838); Sat, 20 Nov 2021 17:05:04 +0000 Received: (at 51838) by debbugs.gnu.org; 20 Nov 2021 17:05:02 +0000 Received: from localhost ([127.0.0.1]:43593 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1moTnR-0003vJ-QY for submit@debbugs.gnu.org; Sat, 20 Nov 2021 12:05:02 -0500 Received: from mail-qv1-f48.google.com ([209.85.219.48]:43641) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1moTnP-0003v5-Jx for 51838@debbugs.gnu.org; Sat, 20 Nov 2021 12:05:00 -0500 Received: by mail-qv1-f48.google.com with SMTP id j9so9298873qvm.10 for <51838@debbugs.gnu.org>; Sat, 20 Nov 2021 09:04:59 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=philipmcgrath.com; s=google; h=message-id:date:mime-version:user-agent:subject:content-language:to :references:from:in-reply-to:content-transfer-encoding; bh=8XqaUeUuQGNTZ8xdOgb7pwod65g/pmsW7ZAJJGjAFeQ=; b=koW2E5I4UhhpzuS7kPKRdYScQijmc4yGhpedqSOse9CQAN/571op9EtTSWDoGTtbsB l5r+Saicc8sgWPOkHzGXEbyHkXt7wNnbaD8Nc/q1cm8fhpGLd8jFfLQHA7fR8wfuIvPe tVwSCRYRmkcuRO3PpwHlLy0RzeuDVL/s6Ddx2mLYa5EeJvrH9HodtRKyMrqpzN/Rm45h ZywyGm72V8pI2W/YG1inldlE6cCFhcyKRt/RfZGH/Ig3IwAIIIFhL1scf5jgcDjK4QCI G7DCfEvcZm18zVEELNBb7bFpigSedR1DsCpb0uHN+jdCgk58Gxx3p8IwbP8YYFeA3AEO 5pYw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:message-id:date:mime-version:user-agent:subject :content-language:to:references:from:in-reply-to :content-transfer-encoding; bh=8XqaUeUuQGNTZ8xdOgb7pwod65g/pmsW7ZAJJGjAFeQ=; b=oU/ttwgnktgpE/MHu3SrC0hIx+J0S4uBBdGei2N0T6c44F6lfucX7rl2CvxGomayhb WQGlfY1A9PQMlTbuySYxNXYXyOJVS7gv1PzUOmPhSfMMjoFKwISFZnVG0OhgD0rehJnu 2HkvFwLnhrHmAYF/3upOTXsCiBX3i9NfOolp24/r9qaBh4xiC+2/ZT4YchBywypyZRh0 1GKM1lYdDgyK6d1pDAqkMBhEnd3PaoUMfnUtKkeckb0+jJiKlgcWnTSKS4q16TKG5KUp C3Nqer3fXUJbz3XpoEzl4uZztHk2YdipU8bFLdxKgUHOdQWb/H00bxQc6WlTmfHdTO1I kXgQ== X-Gm-Message-State: AOAM530eqjgfg52szg4zHGtkkKH3WvxJlCMOeJfp/4Qx5psGMSzaagIA tDp2yVjGVhXJVjqZlJnpRGBo0w== X-Google-Smtp-Source: ABdhPJyaURNfjk/Eco7v9qcFXRqW63NjYDZF4mMXYapvjrpeH2e5heTZ6EBSwvEfmyzZz3fuzLBQzQ== X-Received: by 2002:a05:6214:8f2:: with SMTP id dr18mr84731962qvb.56.1637427890966; Sat, 20 Nov 2021 09:04:50 -0800 (PST) Received: from [192.168.45.37] (c-73-125-89-242.hsd1.fl.comcast.net. [73.125.89.242]) by smtp.gmail.com with ESMTPSA id bi6sm1773917qkb.29.2021.11.20.09.04.50 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Sat, 20 Nov 2021 09:04:50 -0800 (PST) Message-ID: <37768a63-5a4a-b604-2542-e8890fd68a16@philipmcgrath.com> Date: Sat, 20 Nov 2021 12:04:49 -0500 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Thunderbird/91.3.1 Content-Language: en-US References: <5a04aa92-e80d-e11b-235c-b7f5e3a92d00@philipmcgrath.com> <20211120043406.952350-1-philip@philipmcgrath.com> <20211120043406.952350-5-philip@philipmcgrath.com> <8c07272b588fc059f3c445fe1f33c63cce8f31f1.camel@gmail.com> From: Philip McGrath In-Reply-To: <8c07272b588fc059f3c445fe1f33c63cce8f31f1.camel@gmail.com> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list X-BeenThere: guix-patches@gnu.org List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-patches-bounces+larch=yhetil.org@gnu.org Sender: "Guix-patches" X-Migadu-Flow: FLOW_IN X-Migadu-Country: US ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=yhetil.org; s=key1; t=1637427974; h=from:from:sender:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding:resent-cc: resent-from:resent-sender:resent-message-id:in-reply-to:in-reply-to: references:references:list-id:list-help:list-unsubscribe: list-subscribe:list-post:dkim-signature; bh=8XqaUeUuQGNTZ8xdOgb7pwod65g/pmsW7ZAJJGjAFeQ=; b=hMr5h0mplIuG4oB4RNrfUQSZfmmbsKEBillE1e4hyr0f8vk+jjEPRObZcbYvbau7GeHVQD Sq4wiTi/YnSE6siMAvLjlXUgCBwHOZc2t5Wd63zpUwLTVonyziB1IAdssfF6uLqz0JWcRF lI0kM+0b2BMmoM/ne3dNjZh/UoNJFD66r0CoAOlr/MaqQD0aoNCiBp+SHiKrieaE4YZafb ynFKXsxkA7UstJhZ4BiTrRMnOZSdy0PvNU+4mrZmQs6yXQsl0+WL6WJG4tz1uPEe3OR10s g3UwYdWUGZfNjzzPp09Ep5QtDTqPnAGUZK1xTy74TiQcfNuUzKUO5CZZR5EBqQ== ARC-Seal: i=1; s=key1; d=yhetil.org; t=1637427974; a=rsa-sha256; cv=none; b=ajzMW+fB9wTMRJOLvuXzHIQe2msHXaJdd1gyZeIuLVHzl0LIU67T9Cc7pFiFyc0sd22t9Y hSQxsYdgMSgTPHty1nOTR57741lb/K7YV2zUqGBufv6cjeNHZkcPFcaZcgFKw3D7qSSPI0 c9d6qBkkscBdA+TE4MWDUR3g3caYFkK/z2oPNxOHC5BGTO0x239ftmkc2kQrqRtc6tBJ/v 3U+U6s7zD5NWKgOW69e2Zo4GM9nTpkWzZIHUWc/sqRf4/lfT+DXA9VGnC77lZbkab9wlST JjBWzwST5g4m0xOSrrCaUlsycLuH1vX407vDM0AWW2ndOGUlNDMtX3veZCp96A== ARC-Authentication-Results: i=1; aspmx1.migadu.com; dkim=fail ("headers rsa verify failed") header.d=philipmcgrath.com header.s=google header.b=koW2E5I4; dmarc=none; spf=pass (aspmx1.migadu.com: domain of "guix-patches-bounces+larch=yhetil.org@gnu.org" designates 209.51.188.17 as permitted sender) smtp.mailfrom="guix-patches-bounces+larch=yhetil.org@gnu.org" X-Migadu-Spam-Score: -1.87 Authentication-Results: aspmx1.migadu.com; dkim=fail ("headers rsa verify failed") header.d=philipmcgrath.com header.s=google header.b=koW2E5I4; dmarc=none; spf=pass (aspmx1.migadu.com: domain of "guix-patches-bounces+larch=yhetil.org@gnu.org" designates 209.51.188.17 as permitted sender) smtp.mailfrom="guix-patches-bounces+larch=yhetil.org@gnu.org" X-Migadu-Queue-Id: E4FD4C531 X-Spam-Score: -1.87 X-Migadu-Scanner: scn0.migadu.com X-TUID: PUp6rNhFBMl+ Hi, On 11/20/21 02:41, Liliana Marie Prikler wrote: > Hi, > > Am Freitag, den 19.11.2021, 23:33 -0500 schrieb Philip McGrath: >> Many of Guix's Node.js packages are built without some of the >> dependencies they specify in their "package-lock.json" files, >> either because we don't have them packaged yet (e.g. test >> utilities) or because we don't want them (e.g. to reduce the >> closure size). Previously, Guix package definitions would work >> around this situation by deleting the `'configure` >> phase (i.e. the initial `npm install`). >> >> This commit adds an optional #:absent-dependencies argument to >> `node-build-system` to list Node.js packages that should be >> removed from the "package.json" file.Retaining the `'configure` >> phase avoids skipping checks for the dependencies that are >> intended to be present and other actions performed by `npm >> install`, such as automatically building native add-ons with >> `node-gyp` when the "gypfile" key is present. >> >> [...] > This is a somewhat decent approach, but I wonder whether we could > improve this. Does nodejs complain if a dependency exists in the code, > but is not present in the packages.json? To the best of my understanding, npm doesn't inspect the js files at all by default, so no. (A package.json file might define a build script that does more checks.) I think a missing and undeclared dependency manifests itself as a runtime error when the require() function is evaluated. > In the resolve-dependencies subprocedure, we could check whether we > have a matching input somewhere and only include the dependency if we > do. WDYT? I thought about this, but it seems to me there are two problems. First, I'm very unsure about this, but, in the last few days, I've gotten the impression there may be some "package.json" packages that don't correspond directly to Guix packages. I don't really understand how that works, but I think it may have something to do with npm packages that can run either on Node.js or on the web and need to use some functionality that's part of the Node.js core but not the web platform (or vice versa?). I could be wrong about that, but I've tried, especially in v2, to only have the build-side code do things I'm confident are correct in all cases. The other issue is that deleting packages with no matching input by default would replicate some of the drawbacks of the current `(delete 'configure)` approach. I think it's better to have an explicit list of dependencies that Guix is deleting. If eventually we package all of the missing dependencies for Guix, it would be much easier to find the packages that ought to use it. And, in the highly dynamic JavaScript world, I'm reluctant to give up one of the few static checks we have. If a missing package that really was required were automatically deleted from "package.json", it seems the failure mode would by a mysterious runtime error, potentially many steps down a dependency chain.