4 ms·

Regarding point 9, if you don't check your `node_modules` into version control don't you run the risk of them disappearing from NPM?

hunterloftis 11y ago
"If you are paranoid about depending on the npm ecosystem, you should run a private npm mirror or a private cache. If you want 100% confidence in being able to reproduce the specific bytes included in a deployment, you should use an additional mechanism that can verify contents rather than versions. For example, Amazon machine images, DigitalOcean snapshots, Heroku slugs, or simple tarballs." https://docs.npmjs.com/misc/faq#should-i-check-my-node-modules-folder-into-git https://docs.npmjs.com/misc/faq#should-i-check-my-node-modul...
thoughtpalette 11y ago
That's a good point, I've never considered the possibility of a package I'm using disappear from NPM. I never check in my node_modules folder and let CI build processes handle all of that.
vog 11y ago
Even when assuming availability, what about modules that change? Either because authors "bugix" their existing versions and don't bother to increase the version number. Or because a malicious network actor delivered modified code. That's why I prefer to add a SHA-256 hash/checksum to every downloaded dependency file. In some settings that hash might be more important than the actual version number.
- LukeB_UK 11y ago
  npm only lets you publish a version once, if the version number already exists for that module, you have to change the version number
  - vog 11y ago
    Okay, that's good to know. But I'm still uneasy with this, as the crypto hash approach provides some more safety features. For example, it protects against attacks the NPM platform itself (assuming they happen after you incorporated the library into your project). Also, it enables us to download the package from any other source (e.g. some archive/mirror), via plain HTTP, while still being safe from downloading a modified package. That's why I still wish the crypto hashes were included in package.json (automatically on "install --save-exact", of course).
jtwebman 11y ago
I think if you are worried about this you should be using Dockers and Docker Hub.
seivan 11y ago
You could fork the libs and point to your own repo. That's what we usually did with Cocoapods.
draw_down 11y ago
Do you guys not use pip, and stuff? I'm surprised by all the confusion on this point. Package managers are part of modern programming platforms. Repos only need to have your code, not everyone else's.

hunterloftis 11y ago

"If you are paranoid about depending on the npm ecosystem, you should run a private npm mirror or a private cache. If you want 100% confidence in being able to reproduce the specific bytes included in a deployment, you should use an additional mechanism that can verify contents rather than versions. For example, Amazon machine images, DigitalOcean snapshots, Heroku slugs, or simple tarballs." https://docs.npmjs.com/misc/faq#should-i-check-my-node-modules-folder-into-git https://docs.npmjs.com/misc/faq#should-i-check-my-node-modul...

thoughtpalette 11y ago

That's a good point, I've never considered the possibility of a package I'm using disappear from NPM. I never check in my node_modules folder and let CI build processes handle all of that.

vog 11y ago

Even when assuming availability, what about modules that change? Either because authors "bugix" their existing versions and don't bother to increase the version number. Or because a malicious network actor delivered modified code. That's why I prefer to add a SHA-256 hash/checksum to every downloaded dependency file. In some settings that hash might be more important than the actual version number.

LukeB_UK 11y ago
npm only lets you publish a version once, if the version number already exists for that module, you have to change the version number
- vog 11y ago
  Okay, that's good to know. But I'm still uneasy with this, as the crypto hash approach provides some more safety features. For example, it protects against attacks the NPM platform itself (assuming they happen after you incorporated the library into your project). Also, it enables us to download the package from any other source (e.g. some archive/mirror), via plain HTTP, while still being safe from downloading a modified package. That's why I still wish the crypto hashes were included in package.json (automatically on "install --save-exact", of course).

jtwebman 11y ago

I think if you are worried about this you should be using Dockers and Docker Hub.

seivan 11y ago

You could fork the libs and point to your own repo. That's what we usually did with Cocoapods.

draw_down 11y ago

Do you guys not use pip, and stuff? I'm surprised by all the confusion on this point. Package managers are part of modern programming platforms. Repos only need to have your code, not everyone else's.