5 ms·

> One of my biggest pet peeves with NPM is that the packages aren't reproducible[...] Are there any other languages that focus on "reproducible builds" for pack

by cxr 4y ago

> One of my biggest pet peeves with NPM is that the packages aren't reproducible[...] Are there any other languages that focus on "reproducible builds" for packages? NPM isn't a language. (Nor is NodeJS, for that matter.) It doesn't even occupy some semi-official position in its relationship to the actual language. Often, the NPM/NodeJS way even stands in stark contrast—working against the spirit and sometimes even the letter of the relevant standards and language features. (It is pretty remarkable, I admit, how the opinionated set of practices associated with NPM/NodeJS have managed to reach the place it has in the associated cultural dominance hierarchy, to the point that people often forget about this stuff.) > (Ideally via Git) Yeah, and it's super easy: you can make your builds reproducible by committing your source code to Git. All of it. (I.e., the libraries you're using, too.) People get irrationally upset when you suggest it, though; it really feels like it shouldn't be that easy, so they don't let it.

Apes 4y ago
> it's super easy I have a suspicion that you're not putting the source for the specific versions of glibc and Linux you used into every one of your projects.
- cxr 4y ago
  This is not nearly as clever a response as it sounds. It's moving the goalposts. I don't produce anything where Linux's relationship to the application is as something that lives inside the build (unlike the types of third-party NPM dependencies we're talking about here) and I have a suspicion that there isn't any Linux inside the artifacts that your build step produces, either. If that's not the case for you, then yeah, I'll bite the bullet. You absolutely can either: (a) include that source code in your repo or (b) stop building things like that. If you find that going with the former option isn't easy, then that's because it never was—whether you're checking in all the source code or not.
- ar_lan 4y ago
  A Nix package can do this easily!
- rowanG077 4y ago
  Pin a nixpkgs version and you're done.
freeqaz 4y ago
> NPM isn't a language. Fair point! I should have said "Are there any other package managers that focus on reproducible builds?" (Or maybe "ecosystem" would be a better term?) > you can make your builds reproducible by committing your source code to Git. That doesn't help when, for example, a TypeScript NPM module is compiled and "released" with only the JavaScript code + `*.d.ts` files. Or, worse, sometimes the release is entirely minified. (I feel like Deno might be tackling this problem, but I'm not sure.) I agree that checking in the dependencies helps (we do that via Yarn PnP, which has it's own pain points too). It's still not the "end game" solution though like what Nix is targeting.
- cxr 4y ago
  > That doesn't help when, for example, a TypeScript NPM module is compiled and "released" with only the JavaScript code + `*.d.ts` files I don't understand. How does it not help in that scenario (or the minification one)?

by cxr 4y ago

Apes 4y ago

> it's super easy I have a suspicion that you're not putting the source for the specific versions of glibc and Linux you used into every one of your projects.

cxr 4y ago
This is not nearly as clever a response as it sounds. It's moving the goalposts. I don't produce anything where Linux's relationship to the application is as something that lives inside the build (unlike the types of third-party NPM dependencies we're talking about here) and I have a suspicion that there isn't any Linux inside the artifacts that your build step produces, either. If that's not the case for you, then yeah, I'll bite the bullet. You absolutely can either: (a) include that source code in your repo or (b) stop building things like that. If you find that going with the former option isn't easy, then that's because it never was—whether you're checking in all the source code or not.
ar_lan 4y ago
A Nix package can do this easily!
rowanG077 4y ago
Pin a nixpkgs version and you're done.

freeqaz 4y ago

> NPM isn't a language. Fair point! I should have said "Are there any other package managers that focus on reproducible builds?" (Or maybe "ecosystem" would be a better term?) > you can make your builds reproducible by committing your source code to Git. That doesn't help when, for example, a TypeScript NPM module is compiled and "released" with only the JavaScript code + `*.d.ts` files. Or, worse, sometimes the release is entirely minified. (I feel like Deno might be tackling this problem, but I'm not sure.) I agree that checking in the dependencies helps (we do that via Yarn PnP, which has it's own pain points too). It's still not the "end game" solution though like what Nix is targeting.

cxr 4y ago
> That doesn't help when, for example, a TypeScript NPM module is compiled and "released" with only the JavaScript code + `*.d.ts` files I don't understand. How does it not help in that scenario (or the minification one)?