F24 System Wide Change: Node.js 4.2

[Jan Kurik]

= Proposed F24 System Wide Change: Node.js 4.2 =
https://fedoraproject.org/wiki/Changes/NodeJS4x

Change owner(s):
* Stephen Gallagher <sgallagh AT redhat DOT com>
* Jared Smith <jsmith AT fedoraproject DOT org>

Fedora 24 will be updated to Node.js 4.2, the latest LTS release of
the platform built on Chrome's JavaScript runtime for easily building
fast, scalable network applications.

== Detailed Description ==
Node.js has seen many changes between v0.10 and v4.x. There is a
listing of changes documented on the
wiki:https://github.com/nodejs/node/wiki/API-changes-between-v0.10-and-v4
Note that this release includes API updates that may require
dependency updates. Following are some
highlights:https://fedoraproject.org/wiki/Changes/NodeJS4x#Detailed_Descr...

== Scope ==
Proposal owners:
* Update v8
* Update nodejs
* Rebuild all binary modules, apply patches as necessary
* Update npm

Other developers:
* Other Node.js packagers' attention may be required if the update
causes issues for their packages.

Release engineering:
* Upgrade will require a side-tag to coordinate updates.

Policies and guidelines:
* Some minor updates to the Node.js guidelines are planned, however
they are just Nice To Have for the purposes of this specific change.

Trademark approval: N/A (not needed for this Change)
-- 
Jan Kuřík
Platform & Fedora Program Manager
Red Hat Czech s.r.o., Purkynova 99/71, 612 45 Brno, Czech Republic
_______________________________________________
devel-announce mailing list
devel-announce(a)lists.fedoraproject.org
http://lists.fedoraproject.org/admin/lists/[e-mail]...

[Vít Ondruch]

Is there some testing version of v8 somewhere? Will we have time to play
with rubygem-therubyracer, if we can convince it to run with recent v8
or what else have to be done? The same applies for MongoDB if I am not
mistaken.


Vít


Dne 1.12.2015 v 17:58 Jan Kurik napsal(a):
>  = Proposed F24 System Wide Change: Node.js 4.2 =
>  https://fedoraproject.org/wiki/Changes/NodeJS4x
>
>  Change owner(s):
>  * Stephen Gallagher <sgallagh AT redhat DOT com>
>  * Jared Smith <jsmith AT fedoraproject DOT org>
>
>  Fedora 24 will be updated to Node.js 4.2, the latest LTS release of
>  the platform built on Chrome's JavaScript runtime for easily building
>  fast, scalable network applications.
>
>  == Detailed Description ==
>  Node.js has seen many changes between v0.10 and v4.x. There is a
>  listing of changes documented on the
>  wiki:https://github.com/nodejs/node/wiki/API-changes-between-v0.10-and-v4
>  Note that this release includes API updates that may require
>  dependency updates. Following are some
>  highlights:https://fedoraproject.org/wiki/Changes/NodeJS4x#Detailed_Descr...
>
>  == Scope ==
>  Proposal owners:
>  * Update v8
>  * Update nodejs
>  * Rebuild all binary modules, apply patches as necessary
>  * Update npm
>
>  Other developers:
>  * Other Node.js packagers' attention may be required if the update
>  causes issues for their packages.
>
>  Release engineering:
>  * Upgrade will require a side-tag to coordinate updates.
>
>  Policies and guidelines:
>  * Some minor updates to the Node.js guidelines are planned, however
>  they are just Nice To Have for the purposes of this specific change.
>
>  Trademark approval: N/A (not needed for this Change)

[Tom Hughes]

On 02/12/15 08:27, Vít Ondruch wrote:

>  Is there some testing version of v8 somewhere? Will we have time to
> play
>  with rubygem-therubyracer, if we can convince it to run with recent v8
>  or what else have to be done? The same applies for MongoDB if I am not
>  mistaken. 
Stephen Gallagher built nodejs 4.2.2 in the side tag last night, but using a
bundled v8 so it shouldn't affect other users of v8. The spec file now says:

# Node.js is closely tied to the version of v8 that is used with it. It makes
# sense to use the bundled version because upstream consistently breaks ABI
# even in point releases. Node.js upstream has now removed the ability to build
# against a shared system version entirely.
# See https://github.com/nodejs/node/commit/d726a177ed59c37cf5306983ed00ecd858c...
Provides: bundled(v8) = 4.6.85

Tom

-- 
Tom Hughes (tom(a)compton.nu)
http://compton.nu/

[Vít Ondruch]

Dne 2.12.2015 v 09:41 Tom Hughes napsal(a):
>  On 02/12/15 08:27, Vít Ondruch wrote:
>
> > Is there some testing version of v8 somewhere? Will we have time to play
> > with rubygem-therubyracer, if we can convince it to run with recent v8
> > or what else have to be done? The same applies for MongoDB if I am not
> > mistaken.
>  Stephen Gallagher built nodejs 4.2.2 in the side tag last night, but using a
>  bundled v8 so it shouldn't affect other users of v8. 
While the scope says:

== Scope ==
Proposal owners:
* Update v8

>   The spec file now says:
>
>  # Node.js is closely tied to the version of v8 that is used with it. It makes
>  # sense to use the bundled version because upstream consistently breaks ABI
>  # even in point releases. Node.js upstream has now removed the ability to build
>  # against a shared system version entirely.
>  # See https://github.com/nodejs/node/commit/d726a177ed59c37cf5306983ed00ecd858c...
>  Provides: bundled(v8) = 4.6.85 
That is sad ... although they do expect this commit might get reverted ...

Vít

[Stephen Gallagher]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 12/02/2015 07:39 AM, Vít Ondruch wrote:
>  Dne 2.12.2015 v 09:41 Tom Hughes napsal(a):
> > On 02/12/15 08:27, Vít Ondruch wrote:
> > 
> >> Is there some testing version of v8 somewhere? Will we have
> >> time to play with rubygem-therubyracer, if we can convince it
> >> to run with recent v8 or what else have to be done? The same
> >> applies for MongoDB if I am not mistaken.
> > Stephen Gallagher built nodejs 4.2.2 in the side tag last night,
> > but using a bundled v8 so it shouldn't affect other users of v8.
>  
>  While the scope says:
>  
>  == Scope == Proposal owners: * Update v8
>   
Thanks, I need to update that. It was expected when I wrote it, but
that has changed. One advantage here is that Fedora can opt to carry
whatever version of v8 makes sense for other consumers.



> > The spec file now says:
> > 
> > # Node.js is closely tied to the version of v8 that is used with
> > it. It makes # sense to use the bundled version because upstream
> > consistently breaks ABI # even in point releases. Node.js
> > upstream has now removed the ability to build # against a shared
> > system version entirely. # See
> > https://github.com/nodejs/node/commit/d726a177ed59c37cf5306983ed00ecd858c...
> >
> >  
Provides: bundled(v8) = 4.6.85
>  
>  That is sad ... although they do expect this commit might get
>  reverted ...
>   
It's not my preference, certainly. But I spoke with some of the
upstream developers and the simple truth is that they have been broken
consistently by upstream v8 breaking ABI and even API in point
releases. Until and unless Google decides to treat v8 like a shared
lib instead of the copylib that it really is, the only sensible
approach here is to bundle it.

In accordance with the bundling policy, it *is* carrying a virtual
Provides to allow us to identify whether it is affected by discovered
CVEs.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iEYEARECAAYFAlZfAGYACgkQeiVVYja6o6NI1ACgpICyaqLpwluXDPd/wFr64FR6
QLMAn1Uuhgk03vNN0tLm5P6T+/WiuxJ+
=O0S/
-----END PGP SIGNATURE-----

How to collect "bundled" virtual provide

[Vít Ondruch]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Dne 2.12.2015 v 15:30 Stephen Gallagher napsal(a):
>  In accordance with the bundling policy, it *is* carrying a virtual
>  Provides to allow us to identify whether it is affected by discovered
>  CVEs.
>  
This brings me to interesting question, how to actually know that one
should be looking for some bundled library? I don't think this was ever
addressed, but I believe it'd be useful to have some page where we can
see what is bundled and where is it bundled. I don't think that
"repoquery" is the answer, since this does not give good enough overview
nor statistics, etc.


Vít
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v2
>
> iQIcBAEBCAAGBQJWXwRVAAoJEAzgnueZF7h8NdYP/R7S39kRo6tEWWs9+VKsH1DC
> PLZlBcToBluRpQ4rmcvsOG1g+yqOM2HeJZUeMVZzjRHgpvmec3Ywzt+UOC+JIFhp
> XltOUqeHLbKYSkvqdyLx5EXL4rk74agpnIh870zhbxARWIW8ObeMQ1vKF+xH7mNM
> +wickQbjZBCHnk9BMfBNBDjpMcqrOGkMS6P6+pfpuWguYBhcN1KZTg5lMAt9bBg+
> C5EiJE20Tg4OiOy0jzi0KwaE0STDiH8YOGPQ39DFrCLwKItfYXufNzmC3nOGY9iY
> PN/zshyCgSSwLuxRYZUYm7hu7cJNTcqBfdWGGzgAL3FsqBi0xWjn+shTkGTYKEUP
> rk7dbRy01lifthZKTUG+ApZX6Z1pW1cjTZrAUVF96CW+3JUSVSEX4yKQIU6IHHyT
> Zl1lKF/Vv3dhChp96407U8Lv3OH5ex510smPfNCASTVCzNqUKgg9CBpRgjmxnOd+
> dV1rqz4hN5jBulWFF8Qzzp7T6/C9Tx2BOMtUsI9DuxiDjtZcu49Djxvj1jxdfA1C
> a4Hr5lX6awSjCSyPJhWSH6QGSVhgFFlreQ4o8dBt35wZiCOZhL5eFVVaAM39BWgd
> 92RgLC9+Sa5qoUbpBcSBPW95g3myXiDjFU0NE0gIyarMR7MOcMzHb3NgZZX/9ri3
> E2HW7ONwlvGSRUwXRzkD
> =pVz1
> -----END PGP SIGNATURE-----

How to collect "bundled" virtual provide

[Ralf Corsepius]

On 12/02/2015 03:46 PM, Vít Ondruch wrote:
>  -----BEGIN PGP SIGNED MESSAGE-----
>  Hash: SHA256
>
>  Dne 2.12.2015 v 15:30 Stephen Gallagher napsal(a):
> >
> >
> > In accordance with the bundling policy, it *is* carrying a virtual
> > Provides to allow us to identify whether it is affected by discovered
> > CVEs.
> >
>
>  This brings me to interesting question, how to actually know that one
>  should be looking for some bundled library? I don't think this was ever
>  addressed, 
c.f. the section
"Bundling and Duplication of system libraries"
in https://fedoraproject.org/wiki/Packaging:Guidelines

>  but I believe it'd be useful to have some page where we can
>  see what is bundled and where is it bundled. I don't think that
>  "repoquery" is the answer, since this does not give good enough overview
>  nor statistics, etc. 
repoquery has been rendered widely unusable by dnf.


Ralf