Re: npm (mitigation)

[Catonano <catonano@gmail.com>]

[-- Attachment #1: Type: text/plain, Size: 2617 bytes --]

2017-07-14 19:11 GMT+02:00 Jan Nieuwenhuizen <janneke@gnu.org>:

> Catonano writes:
>
> > I read that Jelle and Jan used their own branch in order to have npm
> > based software to be installed in their GuixSD environments, as binary
> > blobs
>
> Jelle wrote a nice and clean npm importer, no binary anything.
>
> Npm packages have the can be source or binary.  Depending on how you
> want to look at it you can make change this source/binary disctinction
> less white/black and turn it into a gray-scale.
>
> As we are talking about javascript, in some cases source and binary
> packages are identical.  In other cases, the binary packages come with
> preprocessed documentation and lack the sources.  Other binary packages
> include minimized javascript and even further into the darkness some
> binary packages do not include the non-minimized javascript.  Then some
> binary packages come with pre-compiled binaries and the worst are binary
> package that do not come with the C/C++ sources that were used to
> compile these binaries.
>
> In all these cases the binary packages can be built from their source
> package.  Here is where it starts to get nasty.  Building a package from
> source can only be done if you have all its dependencies already
> installed.  In theory that should not be a problem.
>
> It appears that the npm ecosystem has manouvered itself into a place
> where bootstrapping seems impossible: it turns out that any serious
> package (notably all npm build system packages) have over 1000
> dependencies, often with cyclic dependencies or even missing packages.
>
> To break this boostrap loop on Guix I have added a couple of patches
> onto Jelle's npm importer branch that implement a --binary flag.  This
> allows binary npm packages to be installed in Guix and serve as a basis
> to build other npm packages from source.
>
> Apparently have no problem*) adding binary blobs for gcc, haskell (...?)
> to Guix.  Similarly we could consider adding a/some binary blobs for npm
> buildsystem packages to Guix and use those for a basis to build
> source-only packages.
>
> > Can I ask you for instructions about how to do that exactly ?
>
>    git clone https://gitlab.com/janneke/guix.git
>
> The branch `npm' is rebased on version-0.13.0, have a look at
>
>    guix import npm --help
>
> and look in gnu/packages/npm.scm for instructions.
>
> Greetings,
> janneke
>
> *) Actually I do not like this very much and that's why some of us seek
>    to remove the need for our bootstrap binaries with our stage0 and Mes
>    projects.
>

Thanks.
Both for the wrap up and for the instructions.

[-- Attachment #2: Type: text/html, Size: 3298 bytes --]