3 ms·

Agreed on second point - one of the first things we looked at when introducing node.js at our company was setting up a private in-house npm repository, similar

by gedy 11y ago

Agreed on second point - one of the first things we looked at when introducing node.js at our company was setting up a private in-house npm repository, similar to what many companies due in the Maven ecosystem to both store private packages and filter/proxy the global repo for outages, problems, etc. It was rather hard and awkward, and there was no solution or support offered from npmjs-the-company. Some time after they introduced private (and hosted) npm repos as a paid offering, but this is still not what a lot of companies want. While perhaps I'm jumping to conclusions, a free in-house offering does not seem to be in their business model and therefore the community has suffered a bit. (I'm aware of the unofficial projects for this)

zer00eyz 11y ago
Vendoring is the concept, and is separate from the underlying mechanics. Having an "in house" repository is one mechanism, but checking the dependencies into version control is another one. There just isn't really a good way to do this in/with NPM, and the top google results seem to actively discourage pursuing this pattern. Many other languages (well the ones I use frequently) not only have a recommendations on vendoring, but also support more than one path to getting the job done (with trade offs naturally).
- diggan 11y ago
  > There just isn't really a good way to do this in/with NPM, and the top google results seem to actively discourage pursuing this pattern. There is. The only problem is fetching packages from a central registry (registry.npmjs.org). The rest that comes with the NPM CLI is good stuff. One way, that I have been exploring is to allow NPM to download from IPFS instead, available over at http://everythingstays.com http://everythingstays.com, and that's just one way it can be solved. The top-level comment have more tools that you can use (but doesn't seem to have been implemented yet)
  - zer00eyz 11y ago
    > The only problem is fetching packages from a central registry (registry.npmjs.org). As I understand and have implemented vendoring in the past, I have always thought of it as a "no external dependencies" solution. If your data center gets DDOS'd durring deployment, things should just work when the attack subsides (assuming you have access). Fetching packages from xxxx.npmjs.org would be sort of antithetical to that idea. Or am I missing something. Everythingstays seems like it would do the job mostly, as long as the "fall back to NPM" can be shut off.
- phaas 11y ago
  Sonatype nexus can proxy npmjs. Works ok for our build servers, but in my setup developers still use npm locally so I don't know if there are any gotchas using nexus exclusively. https://books.sonatype.com/nexus-book/reference/npm-proxying-registries.html https://books.sonatype.com/nexus-book/reference/npm-proxying...
  - gedy 11y ago
    Thanks, the company actually eventually went with that. Our attempt was a few years back, before that was available/known to us.

by gedy 11y ago

zer00eyz 11y ago

Vendoring is the concept, and is separate from the underlying mechanics. Having an "in house" repository is one mechanism, but checking the dependencies into version control is another one. There just isn't really a good way to do this in/with NPM, and the top google results seem to actively discourage pursuing this pattern. Many other languages (well the ones I use frequently) not only have a recommendations on vendoring, but also support more than one path to getting the job done (with trade offs naturally).

diggan 11y ago
> There just isn't really a good way to do this in/with NPM, and the top google results seem to actively discourage pursuing this pattern. There is. The only problem is fetching packages from a central registry (registry.npmjs.org). The rest that comes with the NPM CLI is good stuff. One way, that I have been exploring is to allow NPM to download from IPFS instead, available over at http://everythingstays.com http://everythingstays.com, and that's just one way it can be solved. The top-level comment have more tools that you can use (but doesn't seem to have been implemented yet)
- zer00eyz 11y ago
  > The only problem is fetching packages from a central registry (registry.npmjs.org). As I understand and have implemented vendoring in the past, I have always thought of it as a "no external dependencies" solution. If your data center gets DDOS'd durring deployment, things should just work when the attack subsides (assuming you have access). Fetching packages from xxxx.npmjs.org would be sort of antithetical to that idea. Or am I missing something. Everythingstays seems like it would do the job mostly, as long as the "fall back to NPM" can be shut off.
phaas 11y ago
Sonatype nexus can proxy npmjs. Works ok for our build servers, but in my setup developers still use npm locally so I don't know if there are any gotchas using nexus exclusively. https://books.sonatype.com/nexus-book/reference/npm-proxying-registries.html https://books.sonatype.com/nexus-book/reference/npm-proxying...
- gedy 11y ago
  Thanks, the company actually eventually went with that. Our attempt was a few years back, before that was available/known to us.