Re: npm (mitigation)

[Jelle Licht <jlicht@fsfe.org>]

[-- Attachment #1: Type: text/plain, Size: 1422 bytes --]

Hi Catonano,

I would be be happy to help you with this, but tbh, I am not comfortable
discussing this in-depth on guix-devel, as this seems antithetical to Guix'
goals.
All I will say here is that you need to adapt the npm importer to use the
sources from the npm registry instead of resolving to any 'upstream' urls.
I believe Jan's importer was already able to do this last time I checked,
so you might really only need to checkout their branch and rebase on
current master.

Regardless, the biggest issue that remains is still that npm-land is mired
in cyclical dependencies and a fun-but-not-actually unique dependency
resolving scheme.
I am currently working on a guile version of what Sander did for Nix for
importing entire npm dependency trees, but this will likely lead to lots of
programmatically
defined packages instead of the guix approach of mostly-manually defining
each package. It might therefore be a good candidate for a guix channel, if
that is still
being worked on.

Good luck!

- Jelle

2017-07-14 10:52 GMT+02:00 Catonano <catonano@gmail.com>:

> I read that Jelle and Jan used their own branch in order to have npm based
> software to be installed in their GuixSD environments, as binary blobs
>
> Can I ask you for instructions about how to do that exactly ?
>
> I might need to work a litle on some web siites in the future
>
> Which branch exactly did you use, and how, exactly ?
>
> Thanks
>

[-- Attachment #2: Type: text/html, Size: 1950 bytes --]