From owner-svn-ports-all@freebsd.org Wed May 17 14:49:29 2017 Return-Path: Delivered-To: svn-ports-all@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 4387AD70FC5; Wed, 17 May 2017 14:49:29 +0000 (UTC) (envelope-from naylor.b.david@gmail.com) Received: from mail-wm0-x243.google.com (mail-wm0-x243.google.com [IPv6:2a00:1450:400c:c09::243]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id D950510FA; Wed, 17 May 2017 14:49:28 +0000 (UTC) (envelope-from naylor.b.david@gmail.com) Received: by mail-wm0-x243.google.com with SMTP id y10so4172784wmh.0; Wed, 17 May 2017 07:49:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:organization:user-agent :in-reply-to:references:mime-version; bh=RJ2mQ6lt8sx1rpJI4DiFmTTyJ+hKaShk5ZwCOUpPtLE=; b=G86GfArkQiYt/pUK0Su6NNHH316WMlV5tz1h/Ltf8F3XqWg+0NGQcrUWAen2hj1K8H +vfc+yEVZfZOWRZrttrD3P21FEm2bLmT10aPPXnMsk/3gCAx1n1unq4bHKfqqI45eAat M4KuSLOXQKbsNYKHpb4djuQFGdNT74YLYqczLgRiVQ/0vo7zyGsWYYlM9I7SrhmPupeC BOnkeR5RBDwCHANArtAvu1oH4or8vX/TlUqJgG1flj8ZC3m1N/Vq93vGbs+xcpFNaEG6 6e5FZNWaRIjhVhA0mLKK/HAGCpYlsiaoxpqyCiyYiADIKlzuG0VhcTT4FDoOBWvNV9/f By5A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:organization :user-agent:in-reply-to:references:mime-version; bh=RJ2mQ6lt8sx1rpJI4DiFmTTyJ+hKaShk5ZwCOUpPtLE=; b=otd79TfPSaU+twzhfby3d1d9nc4nUeJU3vQ0kj5S5Q/p3qur3Y9+5W5AXW9+b0F0gC 0u6EaAUVPgxCmj+XEdfKpLatZJq43Y2S4c96RwQbVMW9jz+R0b/3+zgZVglt3lkeytbM dUjVTTbW1qfE4FO0ocW83p4rzamhgWYenHQJMowsFUZwk7bg5KmfEAYNWuP764mwNkaE gG3oNVe4G6NN+MqAx53kqTxFLKdAd95vhml9PuL+Zlfmeedb0QzSSJrZJu4UHZ/LGFpo fik95briJnB1GjqQD8b4tPQAAB2AQgOJ+Y2znla5aTpyzxadBlJqHvpIXWVIs21iJeEA qdsg== X-Gm-Message-State: AODbwcCBzONiRQeuRT/xmmYcz4bcZb4Fey63vltJQEJ6drQ/Xy8FlyZG HWZPpKtguuKt9WmY9p4= X-Received: by 10.28.168.3 with SMTP id r3mr10483415wme.33.1495032567258; Wed, 17 May 2017 07:49:27 -0700 (PDT) Received: from dragon.local ([154.69.114.138]) by smtp.googlemail.com with ESMTPSA id 4sm2927166wry.31.2017.05.17.07.49.25 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 17 May 2017 07:49:26 -0700 (PDT) From: David Naylor To: Adam Weinberger Cc: Rodrigo Osorio , Rodrigo Osorio , ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: Re: svn commit: r440978 - in head: devel devel/npm-amdefine devel/npm-clean-css devel/npm-clean-css/files devel/npm-commander devel/npm-commander/files devel/npm-graceful-readlink devel/npm-source-map ... Date: Wed, 17 May 2017 16:49:23 +0200 Message-ID: <1917876.5GWQEAK6S8@dragon.local> Organization: Private User-Agent: KMail/4.14.10 (FreeBSD/11.0-RELEASE-p8; KDE/4.14.30; amd64; ; ) In-Reply-To: <65F32315-6933-4BA2-8B38-DA3EBD273F76@adamw.org> References: <201705152205.v4FM5kIw055373@repo.freebsd.org> <65F32315-6933-4BA2-8B38-DA3EBD273F76@adamw.org> MIME-Version: 1.0 Content-Type: multipart/signed; boundary="nextPart1731529.AcSlWtebNU"; micalg="pgp-sha512"; protocol="application/pgp-signature" X-BeenThere: svn-ports-all@freebsd.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: SVN commit messages for the ports tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 17 May 2017 14:49:29 -0000 --nextPart1731529.AcSlWtebNU Content-Transfer-Encoding: 7Bit Content-Type: text/plain; charset="us-ascii" On Tuesday, 16 May 2017 09:23:13 Adam Weinberger wrote: > > On 16 May, 2017, at 2:57, Rodrigo Osorio wrote: > > On 05/16/17 00:27, Adam Weinberger wrote: > >>> On 15 May, 2017, at 16:05, Rodrigo Osorio wrote: > >> What do all these ports do that npm doesn't already do, especially given > >> that this will cause breakage for everybody with any of these modules > >> installed globally? > >> > >> # Adam > > > > Hi Adam, > > > > That's npm dependencies that need to be packages properly, I'll feel > > unsafe if the port relies on npm to download external sources from github > > during the packaging, without checking the integrity. > > > > Of course, this could be an issue for peoples who deploys npm packages on > > their own, but how can we handle this ? Maybe dep search path should be > > set manually if you install unpackaged npm tools ? > > > > I run a quick test, but apparently node uses in tree dependencies before > > global. > > > > Cheers > > -- rodrigo > > The point is that clean-css is already installable by "npm install > clean-css" or "npm install -g clean-css". The reason there were no node > modules in the ports tree is that npm handles node modules better, manages > dependencies automatically, and doesn't break things. > > My gut feeling is that these ports are not a good idea. There's currently no > policy about node modules, so you didn't do anything wrong by adding them, > but I don't think these ports are beneficial. I think this covers a broader topic of should we "port" other "packages" of software provided through an external mechanism, such as: 1) pip (Python) 2) nuget (.NET) 3) cran (R) 4) npm (Node.js) All of the above provide there own ways to manage dependencies, to a greater or lesser extent. I think there are three motivators for including these "packages" as part of Ports: - Binaries: some of these "packages" require compiling, and thus need to be kept consistent with the broader ecosystem (i.e. Ports). Keeping these "packages" as part of Ports will ensure consistency with the rest of the system's binaries. - Dependency: a "package" may be a dependency on a i) a binary "package", or ii) a program (i.e. some other port). The dependant could either include the dependency, privately, or the dependency needs to move into Ports. The latter is obviously better from a consistency and maintainability perspective. So, I advocate for the inclusion of these "packages" in Ports. However, if pkg ever develops the ability to "bridge" with these other frameworks then an alternative approach could be warranted. Regards --nextPart1731529.AcSlWtebNU Content-Type: application/pgp-signature; name="signature.asc" Content-Description: This is a digitally signed message part. Content-Transfer-Encoding: 7Bit -----BEGIN PGP SIGNATURE----- iQKTBAABCgB9FiEElI7FEaJ/AwLnmbU6rWP6jday2lUFAlkcYvNfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDk0 OEVDNTExQTI3RjAzMDJFNzk5QjUzQUFENjNGQThERDZCMkRBNTUACgkQrWP6jday 2lU5sA/7BDdMfdTJEKl2DocelaXGudMIMa1L/lFoeZc8TmD6L3DN/KBJREim0LKm FqgdMzH9GVheczyZhLlZV4AJSmdKT5Mhu0svQgRAXgxmXcfuRiH7MAPMaoIbz4It oliP41cGMjBzeeIJvDMIjMArYM/SjXkJfd6exRxHS7uv5+9KaCQMuym12V556wAp iAIrM4sM+x2t7VYfQQLlnQ+uXP8OnhM1GZsCj4ABRd/1oM7IFwi8gfPo0cbEDJD/ 6AMOVW1vhTk+NfI3sscuo4Oe6h4q0+z3NS098r7YPS8a/A3JeN3c+D3r07DGlBen wfQcvatxPjRT+zBbONLZpqnF+qC5tQz0r7SK4urjL/S6IV5nA2iH/RyQOesIGak4 VUaLkbF9JA6PW3XrQCxL4pfigBrGtvCTMbdEH5pnPbG4UOfP6CKjLKSImf6KTgs4 JO5ct/LNU5OCAVEFGQ/9qxeDqNHLQFksfyIHMJnEjz3Zl2hQXAmNPvo5T/Lam5ac g6FHXeFoFSkUnHLl0m6CjupDtVD+XJcIG6GcehY/IoGtPEQNqgx7qZHzOTXoMOne aeAU4lVU4RSATgsfVaRfUgWkRdS1u1X959Zmn5DFV0DTR5YYdFzUJZ20FiToXZ7n FuUXZtFjtWkIoHKOpFetzKf3Zn4c5cITz6Zwp3Ax1NIOzyTgyyo= =cjFK -----END PGP SIGNATURE----- --nextPart1731529.AcSlWtebNU--