View Issue Details

IDProjectCategoryView StatusLast Update
0004364Talerwallet (WebExtensions)public2016-10-11 17:28
ReporterFlorian DoldAssigned ToFlorian Dold 
PrioritynormalSeverityfeatureReproducibilityhave not tried
Status closedResolutionfixed 
Product Version0.0 
Target Version0.1Fixed in Version0.1 
Summary0004364: figure out a strategy to deal with npm packages in automated builds and deployment
DescriptionWe should use npm only for development, not for deployment, due to the integrity and availability problems it has. There are three options:

1. move away from npm, use more reproducible package managers for big compile-time dependencies and vendor run-time dependencies
2. run our own npm mirror/cache (e.g. [1])
3. check node_modules into our repository (non-built, npm install --ignore-scripts)

Option 1 is probably what we should do in the long term, option 2 probably requires too much maintenance, and option 3 makes the repository way to large (it adds about 60mb).



[1] https://github.com/mixu/npm_lazy
TagsNo tags attached.

Activities

Florian Dold

2016-04-22 23:45

manager   ~0010547

maybe somewhat ironically, npm itself [1] just checks in its node_modules into git. We should just do that then ...

Florian Dold

2016-10-10 03:45

manager   ~0011283

Addressed in abd94a7f. Increases the repo size by 5MB.

Some future dependencies may require

$ npm build

to be run when they have post-install scripts.

Issue History

Date Modified Username Field Change
2016-04-05 16:27 Florian Dold New Issue
2016-04-05 16:27 Florian Dold Status new => assigned
2016-04-05 16:27 Florian Dold Assigned To => Florian Dold
2016-04-06 09:41 Christian Grothoff Severity minor => feature
2016-04-06 09:41 Christian Grothoff Product Version => 0.0
2016-04-14 00:58 Christian Grothoff Target Version => 0.1
2016-04-22 23:45 Florian Dold Note Added: 0010547
2016-05-31 09:51 Christian Grothoff Target Version 0.1 => 0.4
2016-10-10 03:45 Florian Dold Note Added: 0011283
2016-10-10 03:45 Florian Dold Status assigned => resolved
2016-10-10 03:45 Florian Dold Resolution open => fixed
2016-10-10 08:27 Christian Grothoff Fixed in Version => 0.1
2016-10-10 08:27 Christian Grothoff Target Version 0.4 => 0.1
2016-10-11 17:28 Christian Grothoff Status resolved => closed