Entropic – A Federated Package Manager for JavaScript

Post by steveklabnik » Fri, Jun 14, 2019, 1:58 PM UTC

kostarelo wrote: post #34

roryrjb wrote: post #26

Earlier quoted context omitted.

I take it to mean that with npm there is a very low barrier for entry. I mean it's not difficult to actually host an apt repo on your own server or on S3, but there's still more you need to know to get to that stage. I personally think that using something like apt for Node.js dependencies is a very good idea. I work with Node at work and on the side, and my/our usual stack is either Debian or Ubuntu. Even when Docke…

I am trying to understand why we make NPM such a big deal (and suddenly have all these projects born to solve the NPM problem) when people have solve the issue of a package repository already. C j Silverio's point (JSConf's talk [1]) was that is NPM's scale that makes it hard. Refs: 1: https://www.youtube.com/watch?v=MO8hZlgK5zc

Post by Boulth » Fri, Jun 14, 2019, 2:04 PM UTC

cjbprime wrote: post #40

Touche wrote: post #37

Earlier quoted context omitted.

I like this approach too. npm at least, and perhaps other package managers, are replicating DNS a bit too much for my taste, by providing their own (centralized) namespace. Why not use the existing namespace that is DNS (which is decentralized). It's pretty nice to be able to host my packages on my own servers with my own domain name.

Usually the motivation is that the federated package names are much longer than the centralized short package names.

Post by neurotrace » Fri, Jun 14, 2019, 2:09 PM UTC

boblebricoleur wrote: post #36

el_programmador wrote: post #33

Earlier quoted context omitted.

Forgive me for being a contrarian but I see nothing more than yet another Stallmanist rant in this? Ceej and company are trying to portray NPM as the villain here, but is the entire JS ecosystem's burden their's to carry? They keep whining that Roald Dahl is miserable and all despite inventing Node and why the NPM founder is so rich with VC money, etc. According to me, therein lies their hypocracy: On one hand, you d…

My point was : node is just a web server and npm just a package manager. There was countless before, there will be countless after, we will continue to code with or without. I have worked with a few technologies and in a few industries and package management is always complicated. The nature of the package management tools are not that important. The passion that this kind of topic seems to unleash looks like the con…

Post by Cthulhu_ » Fri, Jun 14, 2019, 2:36 PM UTC

k__ wrote: post #42

Kovah wrote: post #29

Earlier quoted context omitted.

You can indeed reference a git repository with a single commit specified, like described in the npm install docs[1]. Not very user friendly, but it works. Example: "dependencies": { "myprivatemodule": "git+ssh://git@github.com:user/project.git#commit-hash" } [1] https://docs.npm.red/cli/install.html

This! plus treating every commit as major version and be done with it.

Post by gridlockd » Fri, Jun 14, 2019, 3:08 PM UTC

na85 wrote: post #7

jammi wrote: post #2

I don't believe yet another package manager is going to fix anything, more likely it'll take years to reach maturity, will be riddled with bugs until then, and have some serious fundamental issues on its own that will be revealed down the path, if it ever gains popularity. Don't fix it if it aint broke should be a motto for more developers. Settling for good enough prevents second system effects and retards immaturit…

Most JavaScript-related threads I see on HN feature at least a handful of comments from people who will avow that e.g. the npm ecosystem is hot garbage. Seems to me that it is broke and needs fixed.