Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: WAPM – Package Manager for WebAssembly

wapm.io

Post reply on HN
Print view View original

71–80 of 82 posts

Re: Show HN: WAPM – Package Manager for WebAssembly

#71

Post by asdkhadsj »

yuchi wrote: post #65
krapp wrote: post #63

Earlier quoted context omitted.

Don't let the perfect be the enemy of the good. WASM is barely off the ground and already we have a company trying to establish itself as the authoritative package manager and registry host the way NPM has become for javascript. It's more important to prevent centralization by demanding that there be no authority other than the end user, and by building tools to enforce those expectations, than to have a "holy grail"…

> Don't let the perfect be the enemy of the good We’re not talking about good vs perfect. We’re talking about «a big ball of hairy non-compatible dependencies» vs «an upgradeable declarative definition of dependencies». > I'd rather WAPM be built with their registry as a default option, but designed to be completely agnostic regarding registries or repositories. That’s how npm works, yet you don‘t see git/vcs depende…

In fairness, the OP mentioned Go, but you're dropping details.

Ie, in Go it works just fine but it is more than just plain Git, there is a dependency file. Semver works with the repo itself based on repo tags.

I think you're not arguing against what the spirit of OPs post meant, aka the "like Go" part. Like Go does work, Go is using it and it includes a lock file just like you mentioned.

There are definitely downsides to using repos as dependency resolution hosts, but none of that in my view is what you mentioned. Lockfiles in repos are not complex or unsolvable, I'm not sure why you pit them as such - again, look at Go.

If you want to talk about why repos shouldn't be used, imo, talk about the volatility of them. A de/centralized host specially targeted at distributing source seems to have less volatility in existence when compared to git repos. It's rare to have packed disappear from Cargo (Rust's package manager), but I've had it happen multiple times in Go.

Re: Show HN: WAPM – Package Manager for WebAssembly

#72

Post by Leace »

JeremyBanks wrote: post #6

I like Wasmer, but I very much dislike the idea of another major package repository being owned and operated by a commercial entity. They seem like good people doing valuable work now, but that doesn't tell us very much about who the company will be in five or ten years. I've grown uncomfortable with NPM being operated by NPM Inc instead of The Node.js Foundation, but it's a hard thing to change once it's established…

Agreed. I wonder why package managers can't follow Go's lead in re-using DNS system for packages and then offering a service that just indexes what is available.

Example indexing service: https://godoc.org/

Example package: https://godoc.org/go.uber.org/zap

Re: Show HN: WAPM – Package Manager for WebAssembly

#73

Post by sitapati »

intertextuality wrote: post #70
sitapati wrote: post #68

You guys are missing the forest for the trees. This is truly revolutionary. https://dev.to/jwulf/i-can-t-believe-it-s-webassembly-308c

Then submit that to HN, showcasing what wapm can really do. Instead, people here are rightly cynical. I do not want another private company managing something as fundamental as a package registry. I want them to answer my question about how they are actually going to fund themselves. Especially with the dubious decision to pay for office space in San Francisco.

Done!

I'd fund it through VC investment. It's a market/mind share play aka hosting a community.

Re: Show HN: WAPM – Package Manager for WebAssembly

#74

Post by sitapati »

bayesian_horse wrote: post #17

The documentation such as it is, doesn't even tell me what this is supposed to do (or at least not after a superficial look). Is it for using web assembly binaries on a command line? Or in the browser? Integration with webpack or the like? There is a link on how to install from source, pointing to github, but the link is dead and the organization has no repositories... At the moment, there is not enough momentum behi…

It's a Java/.NET/JS-style VM target. So you can distribute your app with a single binary download, instead of different ones for different Operating Systems.

Re: Show HN: WAPM – Package Manager for WebAssembly

#75

Post by intertextuality »

sitapati wrote: post #73
intertextuality wrote: post #70

Earlier quoted context omitted.

Then submit that to HN, showcasing what wapm can really do. Instead, people here are rightly cynical. I do not want another private company managing something as fundamental as a package registry. I want them to answer my question about how they are actually going to fund themselves. Especially with the dubious decision to pay for office space in San Francisco.

Done! I'd fund it through VC investment. It's a market/mind share play aka hosting a community.

Fault on me for wording it that way.

1) How are you going to earn a profit? Like what is your revenue stream going to be, etc? Not funding.

2) Why do you need an office in downtown San Francisco? Why not work remotely?

Re: Show HN: WAPM – Package Manager for WebAssembly

#76

Post by BubRoss »

JeremyBanks wrote: post #6

I like Wasmer, but I very much dislike the idea of another major package repository being owned and operated by a commercial entity. They seem like good people doing valuable work now, but that doesn't tell us very much about who the company will be in five or ten years. I've grown uncomfortable with NPM being operated by NPM Inc instead of The Node.js Foundation, but it's a hard thing to change once it's established…

Julia uses git and GitHub. This was a stroke of brilliance until microsoft bought GitHub. It still will probably be a clever decision, GitHub could be phased out in favor of another git site.

Re: Show HN: WAPM – Package Manager for WebAssembly

#77

Post by Dayshine »

skybrian wrote: post #50
Godel_unicode wrote: post #41

Earlier quoted context omitted.

If you run on Windows by using e.g. cygwin, you don't run on Windows. See previous statement about WSL. > wasmer itself doesn't even support Windows First, it will: https://github.com/wasmerio/wasmer/issues/51#issuecomment-44... Second, I write code that doesn't run on my terminal all the time, but I need the packages I'm using to be installed and versioned correctly.

Well, obviously both WSL and Cygwin run on Windows (and nowhere else), so, rhetoric aside, could you explain why they are they insufficient for your purposes?

Perhaps I don't want to install several GBs of invasive, hard to manage, and vulnerable linux dependencies to run a package manager unrelated to linux?

Re: Show HN: WAPM – Package Manager for WebAssembly

#78

Post by xmclark »

moosingin3space wrote: post #4

I love WebAssembly/WASI, but I'm concerned about us repeating the mistakes of the past. How does the dependency model work? Can I safely install parallel streams of software? Does it support unprivileged installation? Is the installation stateless (no scriptlets/lifecycle scripts)?

> How does the dependency model work?

Currently dependencies are keyed by namespace, name and version. There is a global namespace that has restricted access. WAPM does not do any dynamic linking of WebAssembly and currently only resolves dependencies one node deep. This will likely change in the future as the story on WebAssembly libraries and dynamic linking becomes more concrete.

> Can I safely install parallel streams of software?

WAPM operates synchronously at the moment, but there is no reason why WAPM should not be able to install dependencies concurrently.

> Does it support unprivileged installation? WAPM installs packages into a "wapm_packages" directory in the current directory. WAPM will probably support global installs in the future. WASI enables a "capability-oriented system", but this is a concern of wasm runtimes, and not WAPM. WAPM only manages wasm binaries.

> Is the installation stateless (no scriptlets/lifecycle scripts)?

WAPM installs with a single command and there are no lifecycle scripts. Ideally, one would install their wasm packages with wapm-cli and not require any intervention from other tools. It was designed to be unobtrusive.

Re: Show HN: WAPM – Package Manager for WebAssembly

#79

Post by moosingin3space »

xmclark wrote: post #78
moosingin3space wrote: post #4

I love WebAssembly/WASI, but I'm concerned about us repeating the mistakes of the past. How does the dependency model work? Can I safely install parallel streams of software? Does it support unprivileged installation? Is the installation stateless (no scriptlets/lifecycle scripts)?

> How does the dependency model work? Currently dependencies are keyed by namespace, name and version. There is a global namespace that has restricted access. WAPM does not do any dynamic linking of WebAssembly and currently only resolves dependencies one node deep. This will likely change in the future as the story on WebAssembly libraries and dynamic linking becomes more concrete. > Can I safely install parallel st…

> WAPM operates synchronously at the moment, but there is no reason why WAPM should not be able to install dependencies concurrently.

I'm sorry, I didn't word that well. In Fedora, there is a feature called Modularity that enables you to switch between different release streams (for instance, Node.js LTS or current). You can do so with `dnf module install nodejs:11` or `dnf module install nodejs:10`. Since `dnf` is installing into a single global space, though, it isn't possible to install both nodejs:11 and nodejs:10, and the Fedora project recommends containers as a solution here. Could WAPM support this use case, without requiring one to buy into the entire container tooling ecosystem?

> no lifecycle scripts

Yes! This could enable a declarative OCI image build tool, which could be used to bridge the gap between Wasmer and the Docker/Kubernetes stack.

Re: Show HN: WAPM – Package Manager for WebAssembly

#80

Post by moosingin3space »

orf wrote: post #40
moosingin3space wrote: post #38

Earlier quoted context omitted.

> How else do you build native modules It is my understanding that wasmer is trying to create a new ecosystem that doesn't rely on native modules. > run initial post-installation configuration scripts It's been my experience, as a long-time Linux user, that this is actually a bad thing. Stateless systems are far easier to work with -- a package manager can be far faster and simpler if it just extracts an archive. I c…

Downloading a dependent native library from an official source, based on the current OS version.

Could this not be done though the dependency system itself, if it were sufficiently generic?
Post reply on HN