Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The GitHub registry public beta is live

help.github.com

Post reply on HN
Print view View original

131–137 of 137 posts

Re: The GitHub registry public beta is live

#131

Post by GordonS »

no_wizard wrote: post #77
itslennysfault wrote: post #74

Earlier quoted context omitted.

This is a feature Azure DevOps (formerly Visual Studio Team Services) has had for at least 3 years now. Their repositories Maven, Gradle, Pip, and NuGet in addition to NPM. I'm always surprised more people don't use it. It's a full featured ticket system, git (PRs / etc), package feeds, and ci/cd in one neat package.

I did not know that. Though, we aren't on Azure for anything at all (AWS for some HIPAA stuff, Google Cloud or our own proxmox cluser for the rest). I know Azure Pipelines is becoming the sort of defacto automated CD/CI pipeline though (used to be Travis for so long) and I've heard nothing but good things about that. Might have to take a look.

It's called Azure DevOps, but beyond technically being (transparently) hosted in Azure data centers, the "Azure" part of the name is pretty meaningless.

Re: The GitHub registry public beta is live

#132

Post by juliusmusseau »

lmm wrote: post #110
bad_user wrote: post #109

Earlier quoted context omitted.

Once a piece of software is released as open source, it can be freely distributed. And Maven Central packages require an open source license. The author might own the copyright, but he licensed that copyright away when publishing on Maven Central. In other words a " copyright takedown request " isn't valid, unless the author was in violation of the copyright of somebody else while publishing those packages and this w…

> In other words a "copyright takedown request" isn't valid, unless the author was in violation of the copyright of somebody else while publishing those packages and this was decided in a court of law. The DMCA process is law. Maven Central (like anyone else who hosts things) have to respond to valid takedown requests (which means taking down content long before any court case; even if a counter-notice is filed the c…

Even bad_user's assertion that "Once a piece of software is [legitimately] released as open source, it can be freely distributed" is not 100% true. There is a mechanism in US copyright law through which copyright holders and their heirs can unilaterally retract copyright grants and licenses 56 years after the initial grant or license.

Granted this is quite the esoteric edge case... at least for now. ;-)

Re: The GitHub registry public beta is live

#133

Post by batat »

jolmg wrote: post #126
Crinus wrote: post #114

Earlier quoted context omitted.

> I wish I could install Firefox or Chrome from a decade ago as easily as I can install the latest versions. You can, on Windows. The secret is the system keeping backwards compatibility in mind for its core APIs, something that most desktop APIs on Unix (outside of X11) do not do.

The main problem in Linux is dependency updates, and I never understood how dependencies in Windows work. Are most programs built as fat binaries that carry all their dependencies with them? Or do Windows programs just never build on top of other 3rd party programs and always just depend on what's provided by the base OS?

Depends, also WinSxS[1] helps.

[1] https://en.wikipedia.org/wiki/Side-by-side_assembly

Re: The GitHub registry public beta is live

#134

Post by eridius »

jolmg wrote: post #128
eridius wrote: post #72

Earlier quoted context omitted.

The default way to consume nixpkgs is through channels which today does not involve git. And a nixpkgs git checkout is over 1GB (my .git dir is currently sitting at 1.4GB on this machine). So that's not great. > If you maintain such a "database", you'd have to explicitly state version info for the dependencies of every package. I don't know what you mean. If I say "I want git v2.10.0" I don't care about dependencies;…

I see I had completely misunderstood what you meant. When I last used NixOS, some 3 years ago I think, I didn't really use the channels. Since I wanted to make some modifications to some files in nixpkgs, I preferred to have the nixpkgs repo locally. Seems I forgot about them. EDIT: > The default way to consume nixpkgs is through channels which today does not involve git. And a nixpkgs git checkout is over 1GB (my .g…

I suppose you could build this database on top of git first, and then transform it to be relative to nixpkgs channel tarballs, since each channel release maps to a git commit.

Re: The GitHub registry public beta is live

#135

Post by bad_user »

ageofwant wrote: post #116
bad_user wrote: post #97

Earlier quoted context omitted.

The point is that it's not your Git repo, usually, when talking of dependencies, so it's not really about what you want. SHAs can't be changed, but they can be deleted. And on GitHub, entire projects, usernames, orgs can be deleted. Or renamed. In case of a user rename, GitHub does maintain redirects for awhile. Until that username is taken by somebody else.

If that is a big concern you can fork. If you are building production systems with dependencies on eggs you can't find in pypi you probably should take control of those in your own copies. I can't recall once that I had to do that for things that I ask money for though... if its not in pypi its probably not worth using. And if it is useful, forking or just copying the module or package into your own code base takes c…

> If that is a big concern you can fork

Surely you must be joking.

Yes it is a big concern and the solution is to use repositories that aren't so volatile.

Re: The GitHub registry public beta is live

#136

Post by civodul »

jolmg wrote: post #46
carapace wrote: post #36

FWIW, Software Heritage already has your github repos: https://www.softwareheritage.org/ https://hn.algolia.com/?query=Software%20Heritage&sort=byPop... And GNU Guix at least will transparently fallback to them: > Since Software Heritage archives source code for the long term, Guix can fall back to the Software Heritage archive whenever it fails to download source code from its original location. The way this fallbac…

You know what'd be really cool? For either Nix or Guix to transparently support installation of any version of any program without hacks like putting an alternate version under a different name or some such. I wish programs didn't require continued maintenance for dependency updates or risk being uninstallable without putting them and a number of dependencies under different package names. I wish I could install Fire…

The `--with-commit` and related options of Guix is one step in that direction: https://guix.gnu.org/manual/en/html_node/Package-Transformat... .

What you suggest in the second paragraph sounds great and definitely doable!

Re: The GitHub registry public beta is live

#137

Post by thefounder »

jayflux wrote: post #125
thefounder wrote: post #121

Earlier quoted context omitted.

What happened when the npm owner decided to remove some packages? Why would you trust one npm owner than the package author? Can't you just cache the package if you need cache?

> What happened when the npm owner decided to remove some packages? They can’t, at least not older packages, I believe they need to contact NPM if they wish to unpublish packages. https://docs.npmjs.com/cli/unpublish

I mean when Registry owner (i.e joyent or node org) removes your package for various reasons. Not to mention that private packages are a pain(i.e you need to spin up your own registry)
Post reply on HN