4 ms·

Vendoring is the concept, and is separate from the underlying mechanics. Having an "in house" repository is one mechanism, but checking the dependencies into ve

Vendoring is the concept, and is separate from the underlying mechanics. Having an "in house" repository is one mechanism, but checking the dependencies into version control is another one. There just isn't really a good way to do this in/with NPM, and the top google results seem to actively discourage pursuing this pattern. Many other languages (well the ones I use frequently) not only have a recommendations on vendoring, but also support more than one path to getting the job done (with trade offs naturally).

diggan 11y ago
> There just isn't really a good way to do this in/with NPM, and the top google results seem to actively discourage pursuing this pattern. There is. The only problem is fetching packages from a central registry (registry.npmjs.org). The rest that comes with the NPM CLI is good stuff. One way, that I have been exploring is to allow NPM to download from IPFS instead, available over at http://everythingstays.com http://everythingstays.com, and that's just one way it can be solved. The top-level comment have more tools that you can use (but doesn't seem to have been implemented yet)
- zer00eyz 11y ago
  > The only problem is fetching packages from a central registry (registry.npmjs.org). As I understand and have implemented vendoring in the past, I have always thought of it as a "no external dependencies" solution. If your data center gets DDOS'd durring deployment, things should just work when the attack subsides (assuming you have access). Fetching packages from xxxx.npmjs.org would be sort of antithetical to that idea. Or am I missing something. Everythingstays seems like it would do the job mostly, as long as the "fall back to NPM" can be shut off.
phaas 11y ago
Sonatype nexus can proxy npmjs. Works ok for our build servers, but in my setup developers still use npm locally so I don't know if there are any gotchas using nexus exclusively. https://books.sonatype.com/nexus-book/reference/npm-proxying-registries.html https://books.sonatype.com/nexus-book/reference/npm-proxying...
- gedy 11y ago
  Thanks, the company actually eventually went with that. Our attempt was a few years back, before that was available/known to us.

diggan 11y ago

> There just isn't really a good way to do this in/with NPM, and the top google results seem to actively discourage pursuing this pattern. There is. The only problem is fetching packages from a central registry (registry.npmjs.org). The rest that comes with the NPM CLI is good stuff. One way, that I have been exploring is to allow NPM to download from IPFS instead, available over at http://everythingstays.com http://everythingstays.com, and that's just one way it can be solved. The top-level comment have more tools that you can use (but doesn't seem to have been implemented yet)

zer00eyz 11y ago
> The only problem is fetching packages from a central registry (registry.npmjs.org). As I understand and have implemented vendoring in the past, I have always thought of it as a "no external dependencies" solution. If your data center gets DDOS'd durring deployment, things should just work when the attack subsides (assuming you have access). Fetching packages from xxxx.npmjs.org would be sort of antithetical to that idea. Or am I missing something. Everythingstays seems like it would do the job mostly, as long as the "fall back to NPM" can be shut off.

phaas 11y ago

Sonatype nexus can proxy npmjs. Works ok for our build servers, but in my setup developers still use npm locally so I don't know if there are any gotchas using nexus exclusively. https://books.sonatype.com/nexus-book/reference/npm-proxying-registries.html https://books.sonatype.com/nexus-book/reference/npm-proxying...

gedy 11y ago
Thanks, the company actually eventually went with that. Our attempt was a few years back, before that was available/known to us.