[Pkg-javascript-devel] Bug#845227: generate sub modules like lodash.isplainobject

[John-David Dalton]

Good luck with all that.

I think the self contained route is probably better since it fits with how
things work with Node and its modules. Something like install the packages
in a clean cache using npm 2 so that they aren't maximally flat. Then tgz
up the package folder. It'll have all deps at their correct versions in
their node_modules folder and be actual package code code instead of
recreations from source. This is also similar to
https://docs.npmjs.com/files/package.json#bundleddependencies.

- JDD
-- 
Pkg-javascript-devel mailing list
Pkg-javascript-devel@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pkg-javascript-devel

[Pkg-javascript-devel] Bug#845227: generate sub modules like lodash.isplainobject

[John-David Dalton]

> That means we have to maintain multiple copies of the same library and
that increases our effort to maintain it.

The maintenance cost is reduced since they're just bundled with the
package. You can treat each release of say gulp as a snapshot of their deps
and bundle it with them. Packages specify dep versions for a reason and
it's not super safe to assume they'll function correctly with deps outside
of those specified ranges.

> When we update a dependency to latest version, we ensure all the
packages depending on it continue to work by running tests

Sounds kinda fragile.

> The terms of the license allow me to flatten the dependencies.

You're totally free to but I'm also free to discourage incorrect use of the
package.


BTW are these Debian packages targeting a specific Node version?

-JDD
-- 
Pkg-javascript-devel mailing list
Pkg-javascript-devel@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pkg-javascript-devel

[Pkg-javascript-devel] Bug#845227: generate sub modules like lodash.isplainobject

[John-David Dalton]

> So in debian we patch grunt to use globally installed modules and tasks.

I'm OK with creating more hoops to jump through in this case. I think the
approach you've outlined is a bit wonky. There are ways to bundle deps
without flattening versions. You could package grunt, gulp, and whatever
else in ways that avoid the need for versionless dependents, by way of self
contained packages.

> The last comment about obstructing it shows your intolerance towards
users of your library. You can try, but if it is Free Software, we'll find
a way.

You're free to use the software under the terms of its license. I'm also
free to not agree with your approach. It's not super great.

-JDD
-- 
Pkg-javascript-devel mailing list
Pkg-javascript-devel@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pkg-javascript-devel

[Pkg-javascript-devel] Bug#845227: generate sub modules like lodash.isplainobject

[Pirate Praveen]

[adding -devel]

On Fri, 9 Dec 2016 00:53:05 -0800 John-David Dalton
 wrote:
> It looks like you've ended up publishing all 407 individual packages as a
> single package 😕
> They were individual to allow folks to cherry-pick individual packages at
> their desired versions for each.
> 
> - JDD

> Hmm... I can't really endorse this.

> Flattening packages to only their latest releases is pretty messy.
> I can't see that ending well. I may take steps to obstruct this kind
of thing in future releases."

I wanted to comment there, but it seems I can't comment there any more.

That is the whole point about Free Software, we are not dependent on the
choices of the developers. We are free to modify the software the way
want not the way the developers want.

Some developers like you want to force their choices on users of their
library. For another example see
https://github.com/humanmade/Salty-WordPress/issues/45 When I use grunt,
I want to be able to use it the way I want, not how grunt developers
want it. So in debian we patch grunt to use globally installed modules
and tasks.

We make sure the tests are passing with the dependencies available in
debian so we can make sure the functionality is not broken when changing
dependency versions.

The last comment about obstructing it shows your intolerance towards
users of your library. You can try, but if it is Free Software, we'll
find a way. This line of thinking is similar to how media companies want
to enforce DRM.



signature.asc
Description: OpenPGP digital signature
-- 
Pkg-javascript-devel mailing list
Pkg-javascript-devel@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pkg-javascript-devel

[Pkg-javascript-devel] Bug#845227: generate sub modules like lodash.isplainobject

[John-David Dalton]

It looks like you've ended up publishing all 407 individual packages as a
single package 
They were individual to allow folks to cherry-pick individual packages at
their desired versions for each.

- JDD
-- 
Pkg-javascript-devel mailing list
Pkg-javascript-devel@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pkg-javascript-devel

[Pkg-javascript-devel] Bug#845227: generate sub modules like lodash.isplainobject

[Pirate Praveen]

On Mon, 21 Nov 2016 22:19:05 +0530 Pirate Praveen 
wrote:
> Some dependencies for gulp [1] declare dependencies like
> lodash.assignwith which current lodash package is not providing.

Just uploaded node-lodash-packages which includes all per method modules



signature.asc
Description: OpenPGP digital signature
-- 
Pkg-javascript-devel mailing list
Pkg-javascript-devel@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pkg-javascript-devel

[Pkg-javascript-devel] Bug#845227: generate sub modules like lodash.isplainobject

[John-David Dalton]

Hi All,

Thanks for your interest in the Lodash package. You all shouldn't need to
build from the source. It's better to simply use the packages as provided.
That way there's less likely to be user error, especially since you're not
familiar with the project.

You can get the packages by querying npm with:
> npm view lodash.isplainobject dist.tarball

which will return:
>
https://registry.npmjs.org/lodash.isplainobject/-/lodash.isplainobject-4.0.6.tgz

Thanks,
-JDD
-- 
Pkg-javascript-devel mailing list
Pkg-javascript-devel@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pkg-javascript-devel

[Pkg-javascript-devel] Bug#845227: generate sub modules like lodash.isplainobject

[Pirate Praveen]

package: node-lodash
severity: important
version: 4.16.6+dfsg-1
control: block -1 by 836722

Some dependencies for gulp [1] declare dependencies like
lodash.assignwith which current lodash package is not providing.

Though this would require updating unglifyjs as current version throws
and error when trying to generate these.

Updating uglifyjs requires packaging yargs [2]. Since there are many
dependencies any help is welcome.

[1] https://wiki.debian.org/Javascript/Nodejs/Tasks/gulp
[2] https://wiki.debian.org/Javascript/Nodejs/Tasks/yargs



signature.asc
Description: OpenPGP digital signature
-- 
Pkg-javascript-devel mailing list
Pkg-javascript-devel@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pkg-javascript-devel