Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: WAPM – Package Manager for WebAssembly

wapm.io

Post reply on HN
Print view View original

1–10 of 82 posts

Re: Show HN: WAPM – Package Manager for WebAssembly

#3

Post by whyrusleeping »

Are all the 'packages' here reproducible? I'd love to be able to run something like `wapm verify `, or `wapm verify --all`. Running arbitrary code from random people on my computer is sketchy even when I can look at the code. Its far more sketchy when I can't.

Re: Show HN: WAPM – Package Manager for WebAssembly

#4

Post by moosingin3space »

I love WebAssembly/WASI, but I'm concerned about us repeating the mistakes of the past.

How does the dependency model work? Can I safely install parallel streams of software? Does it support unprivileged installation? Is the installation stateless (no scriptlets/lifecycle scripts)?

Re: Show HN: WAPM – Package Manager for WebAssembly

#5

Post by syrusakbary »

whyrusleeping wrote: post #3

Are all the 'packages' here reproducible? I'd love to be able to run something like `wapm verify `, or `wapm verify --all`. Running arbitrary code from random people on my computer is sketchy even when I can look at the code. Its far more sketchy when I can't.

We are working on supporting signed packages to assure they can't be tampered with. At the same time WebAssembly provides some nice sandboxing capabilities and we are working to add permissions on top of syscalls, so packages will not do what they are not suppose to do.

Reproducible builds are definitely something great, but they are quite tricky. However we are very open to hear more thoughts on how to do it!

Re: Show HN: WAPM – Package Manager for WebAssembly

#6

Post by JeremyBanks »

I like Wasmer, but I very much dislike the idea of another major package repository being owned and operated by a commercial entity. They seem like good people doing valuable work now, but that doesn't tell us very much about who the company will be in five or ten years.

I've grown uncomfortable with NPM being operated by NPM Inc instead of The Node.js Foundation, but it's a hard thing to change once it's established. We should hesitate to support the establishment of another community package manager by a for-profit company.

Re: Show HN: WAPM – Package Manager for WebAssembly

#8

Post by whyrusleeping »

syrusakbary wrote: post #5
whyrusleeping wrote: post #3

Are all the 'packages' here reproducible? I'd love to be able to run something like `wapm verify `, or `wapm verify --all`. Running arbitrary code from random people on my computer is sketchy even when I can look at the code. Its far more sketchy when I can't.

We are working on supporting signed packages to assure they can't be tampered with. At the same time WebAssembly provides some nice sandboxing capabilities and we are working to add permissions on top of syscalls, so packages will not do what they are not suppose to do. Reproducible builds are definitely something great, but they are quite tricky. However we are very open to hear more thoughts on how to do it!

Signed packages are useful, but still don't solve the problem.

One fairly simple thing you can do to improve this would be to include build scripts as part of the package, and allow people to run those build scripts through wapm. The exact versions of any involved tools will need to be recorded too, but since there arent too many ways to generate wasm blobs yet, this shouldnt be too out there.

Eventually it would be great if everyone had fully reproducible build formulae (kinda like https://github.com/polydawn/repeatr).

Re: Show HN: WAPM – Package Manager for WebAssembly

#9

Post by catern »

Why a new package manager? Why not port an existing well-designed generic package manager such as Nix?

Making a new package manager is very expensive in terms of developer times - developers have to learn yet another new thing to use your platform. Can you justify this?

Edit: For example, as matthewbauer commented below, Nix can support WebAssembly as a compilation target: https://github.com/NixOS/nixpkgs/pull/56555

Re: Show HN: WAPM – Package Manager for WebAssembly

#10

Post by syrusakbary »

localhostdotdev wrote: post #7

anyway, sounds really cool and hoping it gets inspired by things like bundler/homebrew more than npm/yarn. btw it has "telemetry" enabled by default. edit: thanks for the link, didn't find the source previously

The CLI is open-source: https://github.com/wasmerio/wapm-cli

We are also planning to open-source the registry as well :)

Post reply on HN