Re: npm (mitigation)

2017-07-24 Thread Catonano
2017-07-24 17:39 GMT+02:00 Ricardo Wurmus : > > Catonano writes: > > >> I am currently working on a guile version of what Sander did for Nix for > >> importing entire npm dependency trees, but this will likely lead to > lots of > >> programmatically > >> defined packages instead of the guix appro

Re: npm (mitigation)

2017-07-24 Thread Ricardo Wurmus
Catonano writes: >> I am currently working on a guile version of what Sander did for Nix for >> importing entire npm dependency trees, but this will likely lead to lots of >> programmatically >> defined packages instead of the guix approach of mostly-manually defining >> each package. >> > > Wha

Re: npm (mitigation)

2017-07-17 Thread Mike Gerwitz
On Mon, Jul 17, 2017 at 11:45:29 +0200, Catonano wrote: > in my idea I would have build a database withh conditions for being non > free forr every npm package. > > So we could have queried the database for questions like: is there any non > free or non buildable package in the dependency tree of,

Re: npm (mitigation)

2017-07-17 Thread Catonano
Mike, 2017-07-15 5:34 GMT+02:00 Mike Gerwitz : > On Fri, Jul 14, 2017 at 13:57:30 +0200, Jelle Licht wrote: > > Regardless, the biggest issue that remains is still that npm-land is > mired > > in cyclical dependencies and a fun-but-not-actually unique dependency > > resolving scheme. > > I still

Re: npm (mitigation)

2017-07-17 Thread Catonano
2017-07-14 19:11 GMT+02:00 Jan Nieuwenhuizen : > Catonano writes: > > > I read that Jelle and Jan used their own branch in order to have npm > > based software to be installed in their GuixSD environments, as binary > > blobs > > Jelle wrote a nice and clean npm importer, no binary anything. > > N

Re: npm (mitigation)

2017-07-17 Thread Catonano
2017-07-14 13:57 GMT+02:00 Jelle Licht : > Hi Catonano, > > I would be be happy to help you with this, but tbh, I am not comfortable > discussing this in-depth on guix-devel, as this seems antithetical to Guix' > goals. > Ok, at least we made this clear. I'll keep the list off the hook, should I

Re: npm (mitigation)

2017-07-15 Thread Adonay Felipe Nogueira
Note that it's not required to include license notices (not to be confused with the license itself) in the header (or as metadata) of each source file. It's a recommendation, such that if someone gets only that specific file, then that person can easily know and have proof that such file is under t

Re: npm (mitigation)

2017-07-15 Thread Adonay Felipe Nogueira
Hm... If this is indeed true, then it's indeed a concern. I wonder if we can check that out... -- - [[https://libreplanet.org/wiki/User:Adfeno]] - Palestrante e consultor sobre /software/ livre (não confundir com gratis). - "WhatsApp"? Ele não é livre, por isso não uso. Iguais a ele prefiro

Re: npm (mitigation)

2017-07-14 Thread Jelle Licht
2017-07-15 5:34 GMT+02:00 Mike Gerwitz : > On Fri, Jul 14, 2017 at 13:57:30 +0200, Jelle Licht wrote: > > Regardless, the biggest issue that remains is still that npm-land is > mired > > in cyclical dependencies and a fun-but-not-actually unique dependency > > resolving scheme. > > I still think t

Re: npm (mitigation)

2017-07-14 Thread Mike Gerwitz
On Fri, Jul 14, 2017 at 13:57:30 +0200, Jelle Licht wrote: > Regardless, the biggest issue that remains is still that npm-land is mired > in cyclical dependencies and a fun-but-not-actually unique dependency > resolving scheme. I still think the largest issue is trying to determine if a given pack

Re: npm (mitigation)

2017-07-14 Thread Jan Nieuwenhuizen
Catonano writes: > I read that Jelle and Jan used their own branch in order to have npm > based software to be installed in their GuixSD environments, as binary > blobs Jelle wrote a nice and clean npm importer, no binary anything. Npm packages have the can be source or binary. Depending on how

Re: npm (mitigation)

2017-07-14 Thread Jelle Licht
Hi Catonano, I would be be happy to help you with this, but tbh, I am not comfortable discussing this in-depth on guix-devel, as this seems antithetical to Guix' goals. All I will say here is that you need to adapt the npm importer to use the sources from the npm registry instead of resolving to a