From mboxrd@z Thu Jan 1 00:00:00 1970 From: ludo@gnu.org (Ludovic =?utf-8?Q?Court=C3=A8s?=) Subject: Re: NPM and trusted binaries Date: Fri, 09 Sep 2016 10:45:43 +0200 Message-ID: <871t0ta2bs.fsf@gnu.org> References: <87shtiz8f7.fsf@gnu.org> <877farzrdl.fsf@gnu.org> <20160906165048.GC18454@thebird.nl> <87bmzzkt2d.fsf@gnu.org> <87eg4uwzi2.fsf@gnu.org> <87y432jo2b.fsf@gnu.org> <877famw4jn.fsf@gnu.org> <8760q5j4lh.fsf@gnu.org> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:57307) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1biHRd-0008HY-0t for guix-devel@gnu.org; Fri, 09 Sep 2016 04:46:00 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1biHRc-0008Es-7Q for guix-devel@gnu.org; Fri, 09 Sep 2016 04:45:56 -0400 In-Reply-To: <8760q5j4lh.fsf@gnu.org> (Mike Gerwitz's message of "Thu, 08 Sep 2016 20:31:54 -0400") List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: Mike Gerwitz Cc: guix-devel Hi Mike, Mike Gerwitz skribis: > Now how the hell is this enforced with thousands of dependencies that > have not undergone any review, within a community that really couldn't > care less? Even something as simple as the license: package.json has no > legal force; it's _metadata_. > > I feel like this will have to be manually checked no matter how it is > done; any automated process would just be a tool to aid in a > transition and keeping a package up-to-date. I don't really see any > other way. > > So I think that I share in your concern with how such a thing would > possible be done. My point is that if it can't, it shouldn't be at all > (where is where we differ). Yes, that=E2=80=99s a serious concern. Maybe all we can reasonably hope to achieve is to provide a core subset of the free NPM packages in Guix proper, built from source. People may still end up using automatically-generated, unchecked packages for the rest. Nevertheless, that would be an improvement over the status quo. (PyPI, Hackage, CPAN, and CRAN seem to be less problematic in this regard, maybe because they are =E2=80=9Cculturally closer=E2=80=9D to the f= ree software movement.) Ludo=E2=80=99.