On 03/07/2023 17:09, Demi Marie Obenour wrote:
On 7/3/23 11:59, Tom Hughes wrote:
> On 03/07/2023 16:41, Demi Marie Obenour wrote:
>
>> Would it be possible to ensure that Node packages contain only actual source
>> code, as in “the preferred form for making modifications” (quote from GNU GPL,
>> I forget which version)?
>
> The simple answer is maybe in principle but in practice it's
> very hard as numerous previous threads will tell you.
>
> The tar balls from the npmjs registry which constitute the
> released versions of node packages frequently contain such
> things often without the original source or any of the tooling
> to build from it.
>
> The alternative is packaging from the upstream git but even
> then, and even if it is well maintained with version tags, there
> are often huge dependency chains to get all the tools needed to
> actually do the builds.
I thought Fedora policy required shipping actual source code, in
which case this alternative is the only option allowed.
Yes you're right, and there's long been a question of exactly
what constitutes that with javascript packages.
When I was packaging and reviewing Node stuff I certainly tried
to do so where it was in any way feasible.
Minimisers weren't usually too bad - you can always just skip them
after all - but once you start dealing with transpilers it can get a
lot harder plus you often wind up having to write your own build script
because the upstream one is using one of a dozen different Node based
tools each of which has hundreds of dependent modules you would need to
package.
Tom
--
Tom Hughes (tom(a)compton.nu)
http://compton.nu/