Date: Wed, 17 May 2017 16:49:23 +0200 From: David Naylor <naylor.b.david@gmail.com> To: Adam Weinberger <adamw@adamw.org> Cc: Rodrigo Osorio <rodrigo@osorio.me>, Rodrigo Osorio <rodrigo@freebsd.org>, ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: Re: svn commit: r440978 - in head: devel devel/npm-amdefine devel/npm-clean-css devel/npm-clean-css/files devel/npm-commander devel/npm-commander/files devel/npm-graceful-readlink devel/npm-source-map ... Message-ID: <1917876.5GWQEAK6S8@dragon.local> In-Reply-To: <65F32315-6933-4BA2-8B38-DA3EBD273F76@adamw.org> References: <201705152205.v4FM5kIw055373@repo.freebsd.org> <afe6f1eb-502a-3a12-4896-38bdfdbd4f65@osorio.me> <65F32315-6933-4BA2-8B38-DA3EBD273F76@adamw.org>
next in thread | previous in thread | raw e-mail | index | archive | help
--nextPart1731529.AcSlWtebNU Content-Transfer-Encoding: 7Bit Content-Type: text/plain; charset="us-ascii" On Tuesday, 16 May 2017 09:23:13 Adam Weinberger wrote: > > On 16 May, 2017, at 2:57, Rodrigo Osorio <rodrigo@osorio.me> wrote: > > On 05/16/17 00:27, Adam Weinberger wrote: > >>> On 15 May, 2017, at 16:05, Rodrigo Osorio <rodrigo@FreeBSD.org> wrote: > >> What do all these ports do that npm doesn't already do, especially given > >> that this will cause breakage for everybody with any of these modules > >> installed globally? > >> > >> # Adam > > > > Hi Adam, > > > > That's npm dependencies that need to be packages properly, I'll feel > > unsafe if the port relies on npm to download external sources from github > > during the packaging, without checking the integrity. > > > > Of course, this could be an issue for peoples who deploys npm packages on > > their own, but how can we handle this ? Maybe dep search path should be > > set manually if you install unpackaged npm tools ? > > > > I run a quick test, but apparently node uses in tree dependencies before > > global. > > > > Cheers > > -- rodrigo > > The point is that clean-css is already installable by "npm install > clean-css" or "npm install -g clean-css". The reason there were no node > modules in the ports tree is that npm handles node modules better, manages > dependencies automatically, and doesn't break things. > > My gut feeling is that these ports are not a good idea. There's currently no > policy about node modules, so you didn't do anything wrong by adding them, > but I don't think these ports are beneficial. I think this covers a broader topic of should we "port" other "packages" of software provided through an external mechanism, such as: 1) pip (Python) 2) nuget (.NET) 3) cran (R) 4) npm (Node.js) All of the above provide there own ways to manage dependencies, to a greater or lesser extent. I think there are three motivators for including these "packages" as part of Ports: - Binaries: some of these "packages" require compiling, and thus need to be kept consistent with the broader ecosystem (i.e. Ports). Keeping these "packages" as part of Ports will ensure consistency with the rest of the system's binaries. - Dependency: a "package" may be a dependency on a i) a binary "package", or ii) a program (i.e. some other port). The dependant could either include the dependency, privately, or the dependency needs to move into Ports. The latter is obviously better from a consistency and maintainability perspective. So, I advocate for the inclusion of these "packages" in Ports. However, if pkg ever develops the ability to "bridge" with these other frameworks then an alternative approach could be warranted. Regards --nextPart1731529.AcSlWtebNU Content-Type: application/pgp-signature; name="signature.asc" Content-Description: This is a digitally signed message part. Content-Transfer-Encoding: 7Bit -----BEGIN PGP SIGNATURE----- iQKTBAABCgB9FiEElI7FEaJ/AwLnmbU6rWP6jday2lUFAlkcYvNfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDk0 OEVDNTExQTI3RjAzMDJFNzk5QjUzQUFENjNGQThERDZCMkRBNTUACgkQrWP6jday 2lU5sA/7BDdMfdTJEKl2DocelaXGudMIMa1L/lFoeZc8TmD6L3DN/KBJREim0LKm FqgdMzH9GVheczyZhLlZV4AJSmdKT5Mhu0svQgRAXgxmXcfuRiH7MAPMaoIbz4It oliP41cGMjBzeeIJvDMIjMArYM/SjXkJfd6exRxHS7uv5+9KaCQMuym12V556wAp iAIrM4sM+x2t7VYfQQLlnQ+uXP8OnhM1GZsCj4ABRd/1oM7IFwi8gfPo0cbEDJD/ 6AMOVW1vhTk+NfI3sscuo4Oe6h4q0+z3NS098r7YPS8a/A3JeN3c+D3r07DGlBen wfQcvatxPjRT+zBbONLZpqnF+qC5tQz0r7SK4urjL/S6IV5nA2iH/RyQOesIGak4 VUaLkbF9JA6PW3XrQCxL4pfigBrGtvCTMbdEH5pnPbG4UOfP6CKjLKSImf6KTgs4 JO5ct/LNU5OCAVEFGQ/9qxeDqNHLQFksfyIHMJnEjz3Zl2hQXAmNPvo5T/Lam5ac g6FHXeFoFSkUnHLl0m6CjupDtVD+XJcIG6GcehY/IoGtPEQNqgx7qZHzOTXoMOne aeAU4lVU4RSATgsfVaRfUgWkRdS1u1X959Zmn5DFV0DTR5YYdFzUJZ20FiToXZ7n FuUXZtFjtWkIoHKOpFetzKf3Zn4c5cITz6Zwp3Ax1NIOzyTgyyo= =cjFK -----END PGP SIGNATURE----- --nextPart1731529.AcSlWtebNU--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?1917876.5GWQEAK6S8>