Live data from Hacker News

Show HN: Esy – fast and simple package management for native ReasonML/OCaml

esy.sh

11–17 of 17 posts

Re: Show HN: Esy – fast and simple package management for native ReasonML/OCaml

#11
post #9

I'm having a hard time figuring out if esy supports reproducable builds, and package signing+verfication. And if reproducable builds are supported, what format is used to store the build information so downloaded packages can be reproduced.

esy tries hard to enable reproducible builds: - esy builds are happening in an isolated environment with only specified dependencies available - esy executes build processes under sandboxing (so builds can't write into arbitrary locations, we have some work to do here though) - esy has feature which allows to rewrite binaries to remove prefix paths from them. As for package signing+verification (assuming you are talk…

And how is the build env recorded for timestamps and env variables? Is all of this standardized?

>we do only integrity checks now for packages downloaded from npm and via opam

Which is fine, but esy should be capable of accepting signatures and checking them against a given key.

Re: Show HN: Esy – fast and simple package management for native ReasonML/OCaml

#12

Earlier quoted context omitted.

esy tries hard to enable reproducible builds: - esy builds are happening in an isolated environment with only specified dependencies available - esy executes build processes under sandboxing (so builds can't write into arbitrary locations, we have some work to do here though) - esy has feature which allows to rewrite binaries to remove prefix paths from them. As for package signing+verification (assuming you are talk…

And how is the build env recorded for timestamps and env variables? Is all of this standardized? >we do only integrity checks now for packages downloaded from npm and via opam Which is fine, but esy should be capable of accepting signatures and checking them against a given key.

> And how is the build env recorded for timestamps and env variables? Is all of this standardized?

We do record the build env now in esy's own format, you run:

    esy build-plan PKG
to see the build plan (a-la Nix derivation) which is a JSON with build commands and environment.

As regarding timestamps we don't set SOURCE_DATE_EPOCH yet but we definitely plan to address that.

Re: Show HN: Esy – fast and simple package management for native ReasonML/OCaml

#13
This looks very nice! I wonder if it might be easy(ish) to wrap it as a plug-in for asdf? There's already an opam/ocaml plug-in - but from comments here it sounds like it might be possible to write a wrapper similar to the ruby plug-in that re-uses a lot of the tooling for rbenv/build. (as does the rust plug-in, and others)

https://github.com/asdf-vm/asdf

Re: Show HN: Esy – fast and simple package management for native ReasonML/OCaml

#14

Hi, I'm one of the developers of esy, would be happy to answer any questions about it. I have background in JS ecosystem and always liked how npm/yarn allows you to have a set of dependencies installed per project which do not conflict with any other global installations. Then this goes even beyond runtime dependencies and you have tools like eslint/flow and others installed per project in node_modules. Now enter nat…

hi Andrey,

thanks for yor work on esy, everytime it comes up I have a look at the documentation and the latest developments. It looks like a nice project, but I'm still a little confused about its purpose. You mention your JS background, so is it all about familiarity to npm? Or are there other things you gain when you run esy on top of dune?

And my other question? It doesn't run with bucklescript - right? Are there specific reasons?

Ben

Re: Show HN: Esy – fast and simple package management for native ReasonML/OCaml

#15
post #14

Hi, I'm one of the developers of esy, would be happy to answer any questions about it. I have background in JS ecosystem and always liked how npm/yarn allows you to have a set of dependencies installed per project which do not conflict with any other global installations. Then this goes even beyond runtime dependencies and you have tools like eslint/flow and others installed per project in node_modules. Now enter nat…

hi Andrey, thanks for yor work on esy, everytime it comes up I have a look at the documentation and the latest developments. It looks like a nice project, but I'm still a little confused about its purpose. You mention your JS background, so is it all about familiarity to npm? Or are there other things you gain when you run esy on top of dune? And my other question? It doesn't run with bucklescript - right? Are there…

Hi Ben,

> It looks like a nice project, but I'm still a little confused about its purpose. You mention your JS background, so is it all about familiarity to npm?

I think familiarity with npm is important here!

I mentioned that npm allows you to have all dependencies of the project local.

Now if we want the same experience for a native project it gets more complex: we can't just install OCaml/Reason/C/C++ code into node_modules, it's not going to work.

So what esy does is it constructs for each package a "perfectly" isolated build environment based on dependencies declared in package.json, which is then used to produce build output (executable or library). Such environment contains things like `$PATH`, `$OCAMLPATH`, `$PKG_CONFIG_PATH` and etc, so these are all environment variable which C/OCaml/Reason/... software can understand.

Now it looks like this (super simplified!):

    esy build: package.json -> isolated build environment -> build output
Now because such isolated build environment depends only on the package.json (I simplify a bit here... later on that) and the build output depends only on its build environment we can easily compute a cache key for each package build output just by looking at package.json of the package.

So esy has smart cache for builds which makes each package build work like this:

      let KEY = hash(package.json) # this is very cheap
      if ~/.esy/store/KEY
        done
      else
        build(package.json, ~/.esy/store/KEY) # this is not cheap!
It means in practice that if you have completely separate esy projects which depend on the same version of `ocaml` (or `gcc` or any other package) then esy will build that version of `ocaml` just once. So those "every local" dependencies are super cheap once you have esy cache warm.

(the key isn't really hash(package.json) but more like hash(package.json + esy.lock) as we need to resolve dependency constraints to concrete versions first using "esy install" command)

> Or are there other things you gain when you run esy on top of dune?

The correct comparison is to dune on top of opam, I think (opam, the command line program, not opam, the registry as esy supports opam registry too!):

- with opam you manage switches manually (switches are like installed package sets), if you need a switch per project - you create a local switch per project

- with opam every time you create switch you need to compile everything from scratch, with esy we try to reuse as much as possible from the build cache

- you use dune with esy the same way you use dune with opam but you need to prefix dune invocations with esy: "esy dune ...", so that way dune sees esy build environment

- with esy you can pull packages from npm/opam/github/tarballs/...

- there's mechanism called `link:`[2] which allows to develop multiple packages as parts of the same project (so called monorepo workflow).

- ...

Some of these things are possible with opam too (not sure about smart cache though and I think it's pretty important) but with esy we've tried to provide the same experience as when you develop with npm/yarn (of course we wanted to solve gigantic node_modules issue and thus we have pnp, and flaky dependency constraints and thus we have a proper SAT solver, the same used by opam). So you might consider this a different UX to develop native code which is focused on Reason/OCaml.

> And my other question? It doesn't run with bucklescript - right? Are there specific reasons?

It doesn't integrate with bucklescript very well now but you still can use esy with bucklescript projects so you can install Merlin (IDE assistant) or other tools from Reason / OCaml ecosystem.

The way how bucklescript works right now isn't compatible with esy - for example we use pnp[1] installation mechanism (same as yarn) so we don't produce node_modules and thus we are fast and package sources are cached globally - for now bucklescript doesn't understand how resolve package sources from pnp.js runtime and thus it can't work with esy directly.

If bucklescript implements support with pnp then it will be perfectly usable with esy but for now you can use package.json for npm/yarn for bucklescript dependencies and esy.json (esy looks for esy.json before package.json) for native dependencies.

[1]: https://github.com/yarnpkg/rfcs/pull/101 [2]: https://esy.sh/docs/en/linking-workflow.html

Re: Show HN: Esy – fast and simple package management for native ReasonML/OCaml

#16
post #14

Earlier quoted context omitted.

hi Andrey, thanks for yor work on esy, everytime it comes up I have a look at the documentation and the latest developments. It looks like a nice project, but I'm still a little confused about its purpose. You mention your JS background, so is it all about familiarity to npm? Or are there other things you gain when you run esy on top of dune? And my other question? It doesn't run with bucklescript - right? Are there…

Hi Ben, > It looks like a nice project, but I'm still a little confused about its purpose. You mention your JS background, so is it all about familiarity to npm? I think familiarity with npm is important here! I mentioned that npm allows you to have all dependencies of the project local. Now if we want the same experience for a native project it gets more complex: we can't just install OCaml/Reason/C/C++ code into no…

thanks for your explanations.

> - with opam every time you create switch you need to compile everything from scratch, with esy we try to reuse as much as possible from the build cache

Yes, that's definitely useful.

> [...] for now you can use package.json for npm/yarn for bucklescript dependencies and esy.json (esy looks for esy.json before package.json) for native dependencies.

So by acting like we use esy on Bucklescript, when we actually use npm, we get a very similar result?

Re: Show HN: Esy – fast and simple package management for native ReasonML/OCaml

#17
post #16

Earlier quoted context omitted.

Hi Ben, > It looks like a nice project, but I'm still a little confused about its purpose. You mention your JS background, so is it all about familiarity to npm? I think familiarity with npm is important here! I mentioned that npm allows you to have all dependencies of the project local. Now if we want the same experience for a native project it gets more complex: we can't just install OCaml/Reason/C/C++ code into no…

thanks for your explanations. > - with opam every time you create switch you need to compile everything from scratch, with esy we try to reuse as much as possible from the build cache Yes, that's definitely useful. > [...] for now you can use package.json for npm/yarn for bucklescript dependencies and esy.json (esy looks for esy.json before package.json) for native dependencies. So by acting like we use esy on Buckle…

> So by acting like we use esy on Bucklescript, when we actually use npm, we get a very similar result?

Yeah, we use npm in that case just to fetch deps and layout them in node_modules which bucklescript understands. Otherwise we use esy for native built tools (ocamlmerlin, preprocessors and etc).

Post reply on HN