12:44 p.m.
https://fedoraproject.org/wiki/Changes/NodejsLibrariesBundleByDefault
== Summary ==
For Nodejs, Fedora should only package:
* The interpreter, development headers/libraries, and the assorted
tools to manage project-level installations (NPM, yarn, etc.).
* Packages that provide binaries that users would want to use in their shell.
* compiled/binary nodejs modules (for now)
== Owner ==
* Name: [[User:tdawson| Troy Dawson]]
* Email: tdawson(a)redhat.com
* Name: [[User:sgallagh| Stephen Gallagher]]
* Email: sgallagh(a)redhat.com
* Name: [[https://developer.fedoraproject.org/tech/languages/nodejs/SIG.html|
Nodejs SIG]]
* Email: nodejs(a)lists.fedoraproject.org
== Detailed Description ==
The nodejs libraries have been approved to be bundled, and there is
infrastructure in place for the bundling to work properly. Currently,
it is recommended that packagers should create individual nodejs
library packages instead of bundling all of the libraries into the
package requiring them.
This change is to make it default to bundle the nodejs libraries with
the package that needs them, and retire the vast majority of nodejs
library packages.
In summary, for Nodejs Fedora should only package:
* The interpreter, development headers/libraries, and the assorted
tools to manage project-level installations (NPM, yarn, etc.).
* Packages that provide binaries that users would want to use in their shell.
* compiled/binary nodejs modules (for now)
== Feedback ==
There has been a discussion on the fedora nodejs mailing list about
what to do with the extreme dependency problem of the nodejs library
packages. Because of the extreme inter-dependency, upgrading almost
any package causes others to break. It has caused most packages to
rot, remaining on unsupported versions for years. Many of the nodejs
packagers are giving up and orphaning their packages, which has caused
even more problems.
An initial proposal was to find all of the important nodejs library
packages and bundle those, making them easier to upgrade and maintain.
But there was problems with figuring out what was important, and what
versions should those have. During that discussion, this rather
extreme solution of getting rid of all nodejs libraries was proposed.
To our surprise, it has been the best received suggestion and fixes
the most problems.
== Benefit to Fedora ==
* In Fedora 33, there are many nodejs libraries that are
uninstallable, thus causing other programs based off them to also be
uninstallable. This gets rid of that problem.
* Packages in Fedora that use nodejs libraries will be able to use the
library versions that upstream has tested and approved.
* If a package in Fedora uses a nodejs library, the packager will not
have to also package extra individual nodejs library packages. There
have been times this has led to over 100 extra packages, each with
their own package reviews and maintenance problems. This change will
lower the workload on that packager, and possibly get more packages
into Fedora.
* The nodejs maintainers can concentrate on nodejs itself, instead of
the whole nodejs library infrastructure.
* Nodejs developers using Fedora will no longer have to worry about
Fedora's global nodejs libraries causing conflicts or inconsistencies.
== Scope ==
* Proposal owners:
We will go through the Fedora release and determine what nodejs
packages Fedora should package. We will implement nodejs library
bundling on those we already own. For those that we do not own, we
will work with their owners to implement nodejs library bundling.
As packages implement nodejs library bundling, we will monitor the
nodejs libraries and note which ones are no longer required. When
they are no longer required, we will retire them, if we own them. If
we do not own them, we will work with the owners to retire them, if
they wish.
* Other developers:
For Fedora packagers whose package rely on nodejs libraries, please
contact the [[https://developer.fedoraproject.org/tech/languages/nodejs/SIG.html|
Nodejs SIG]] and we will help you find the easiest way to bundle your
nodejs libraries.
For Fedora nodejs library packages, look to see what depends on your
library. If it looks like you can do so, retire your nodejs library.
If you would like, give the
[[https://developer.fedoraproject.org/tech/languages/nodejs/SIG.html|
Nodejs SIG]] admin to your nodejs libraries, and they will work
through the process for you.
* Release engineering: [https://pagure.io/releng/issues #Releng issue
number] (a check of an impact with Release Engineering is needed)
* Policies and guidelines: N/A (not a System Wide Change)
* Trademark approval: N/A (not needed for this Change)
* Alignment with Objectives:
== Upgrade/compatibility impact ==
N/A
== How To Test ==
* Install all nodejs libraries in Fedora 33. Try to update to Fedora 34.
* Try to install all packages that require nodejs in Fedora 34.
* Install all packages that require nodejs in Fedora 33. Try to
update to Fedora 34.
== User Experience ==
non-developer end users should not see anything different. Their
nodejs binaries should continue to work.
Nodejs developers using Fedora will no longer have to worry about
Fedora's global nodejs libraries causing conflicts or inconsistencies.
== Dependencies ==
As nodejs library packages are removed, we will work with the various
packages that depend on them. We will help them bundle their nodejs
libraries.
== Contingency Plan ==
Since we will be bundling the nodejs binaries, before we remove their
current dependencies, we will simply stop where we are at the freeze.
There will be nothing to back out.
* Contingency mechanism: N/A
* Contingency deadline: N/A
* Blocks release? N/A
* Blocks product? N/A
== Documentation ==
N/A (not a System Wide Change)
--
Ben Cotton
He / Him / His
Senior Program Manager, Fedora & CentOS Stream
Red Hat
TZ=America/Indiana/Indianapolis
1:18 p.m.
New subject: Fedora 34 Change: Stop Shipping Individual Nodejs Library
Packages (Self-Contained)
On 12/9/20 7:44 PM, Ben Cotton wrote:
== How To Test ==
* Install all nodejs libraries in Fedora 33. Try to update to Fedora 34.
What is the plan wrt Obsoletes of the removed packages?
--
Miro Hrončok
--
Phone: +420777974800
IRC: mhroncok
2:56 p.m.
New subject: Fedora 34 Change: Stop Shipping Individual Nodejs Library
Packages (Self-Contained)
On Wed, Dec 9, 2020 at 11:21 AM Miro Hrončok <mhroncok(a)redhat.com> wrote:
On 12/9/20 7:44 PM, Ben Cotton wrote:
> == How To Test ==
>
> * Install all nodejs libraries in Fedora 33. Try to update to Fedora 34.
What is the plan wrt Obsoletes of the removed packages?
--
Miro Hrončok
--
We do not plan on obsoleting them.
Obsoleting them has the potential to break third party software.
dnf should also clean things up by seeing that the dependencies of an
upgraded package have gone away.
If dnf misses it, these are libraries, not binaries. If nothing is
using them, they just take up some disk space. If a user really wants
to clean them up, those types of users usually have their favorite
ways of doing so.
Troy
5:42 p.m.
New subject: Fedora 34 Change: Stop Shipping Individual Nodejs Library
Packages (Self-Contained)
On 12/9/20 9:56 PM, Troy Dawson wrote:
On Wed, Dec 9, 2020 at 11:21 AM Miro Hrončok
<mhroncok(a)redhat.com> wrote:
>
> On 12/9/20 7:44 PM, Ben Cotton wrote:
>> == How To Test ==
>>
>> * Install all nodejs libraries in Fedora 33. Try to update to Fedora 34.
>
> What is the plan wrt Obsoletes of the removed packages?
>
> --
> Miro Hrončok
> --
We do not plan on obsoleting them.
Obsoleting them has the potential to break third party software.
dnf should also clean things up by seeing that the dependencies of an
upgraded package have gone away.
If dnf misses it, these are libraries, not binaries. If nothing is
using them, they just take up some disk space. If a user really wants
to clean them up, those types of users usually have their favorite
ways of doing so.
I worry about this specific case: There are several JS libraries unbundled in
python-notebook. Due to RPM/DNF limitations, they can onyl be unbondled if the
JS packages are obsoleted:
https://bugzilla.redhat.com/show_bug.cgi?id=1787079#c8
I can definitively make sure the relevant packages are obsoleted by
fedora-obsolete-packages but that opens a can of worm, because if only some
removed packages are obsoleted, other removed packages will block the upgrade
path to Fedora 34/35. And they will need to be obsoleted as well.
I rutinelly spend several hours each release to figure out and fix upgrade path
issues by obsoleting packages via fedora-obsolete-packages. I'd like some help
with this by the change owners / NodeJS SIG. Can I count on that?
--
Miro Hrončok
--
Phone: +420777974800
IRC: mhroncok
4:31 p.m.
New subject: Fedora 34 Change: Stop Shipping Individual Nodejs Library
Packages (Self-Contained)
On Wed, Dec 9, 2020 at 3:42 PM Miro Hrončok <mhroncok(a)redhat.com> wrote:
On 12/9/20 9:56 PM, Troy Dawson wrote:
> On Wed, Dec 9, 2020 at 11:21 AM Miro Hrončok <mhroncok(a)redhat.com> wrote:
>>
>> On 12/9/20 7:44 PM, Ben Cotton wrote:
>>> == How To Test ==
>>>
>>> * Install all nodejs libraries in Fedora 33. Try to update to Fedora 34.
>>
>> What is the plan wrt Obsoletes of the removed packages?
>>
>> --
>> Miro Hrončok
>> --
>
> We do not plan on obsoleting them.
> Obsoleting them has the potential to break third party software.
> dnf should also clean things up by seeing that the dependencies of an
> upgraded package have gone away.
> If dnf misses it, these are libraries, not binaries. If nothing is
> using them, they just take up some disk space. If a user really wants
> to clean them up, those types of users usually have their favorite
> ways of doing so.
I worry about this specific case: There are several JS libraries unbundled in
python-notebook. Due to RPM/DNF limitations, they can onyl be unbondled if the
JS packages are obsoleted:
https://bugzilla.redhat.com/show_bug.cgi?id=1787079#c8
I can definitively make sure the relevant packages are obsoleted by
fedora-obsolete-packages but that opens a can of worm, because if only some
removed packages are obsoleted, other removed packages will block the upgrade
path to Fedora 34/35. And they will need to be obsoleted as well.
I rutinelly spend several hours each release to figure out and fix upgrade path
issues by obsoleting packages via fedora-obsolete-packages. I'd like some help
with this by the change owners / NodeJS SIG. Can I count on that?
The js- (javascript) packages are something I haven't tested with my
bundling scripts and thus do not feel confident in documenting and
removing them at this time. There are currently only 20 of them, and
I think we will add them to our exceptions list, along with the binary
nodejs libraries. Hopefully by F35 or F36 we will be able to get to
them.
But other than those, yes, I believe the Nodejs sig can help with
upgrade path issues and obsoleting packages that need to be obsoleted.
Troy
1:46 p.m.
On Wed, Dec 9, 2020, at 1:44 PM, Ben Cotton wrote:
https://fedoraproject.org/wiki/Changes/NodejsLibrariesBundleByDefault
== Summary ==
For Nodejs, Fedora should only package:
* The interpreter, development headers/libraries, and the assorted
tools to manage project-level installations (NPM, yarn, etc.).
* Packages that provide binaries that users would want to use in their shell.
* compiled/binary nodejs modules (for now)
Better title would have been, "bundle all nodejs dependencies into binary packages
requiring them".
It feels contrary to the Minimization Objective. Is there really no better solution? Can
modularity help here? Better packaging macros?
How will licensing of dependencies be verified? What happens when a project adds new
dependencies?
V/r,
James Cassell
2:45 p.m.
New subject: Fedora 34 Change: Stop Shipping Individual Nodejs Library
Packages (Self-Contained)
On Wed, Dec 9, 2020 at 11:52 AM James Cassell
<fedoraproject(a)cyberpear.com> wrote:
On Wed, Dec 9, 2020, at 1:44 PM, Ben Cotton wrote:
> https://fedoraproject.org/wiki/Changes/NodejsLibrariesBundleByDefault
>
> == Summary ==
>
> For Nodejs, Fedora should only package:
> * The interpreter, development headers/libraries, and the assorted
> tools to manage project-level installations (NPM, yarn, etc.).
> * Packages that provide binaries that users would want to use in their shell.
> * compiled/binary nodejs modules (for now)
>
Better title would have been, "bundle all nodejs dependencies into binary packages
requiring them".
Yes ... that does sound better. Naming is hard.
It feels contrary to the Minimization Objective. Is there really no
better solution? Can modularity help here? Better packaging macros?
To me this sounds exactly in line with the Minimization Objective.
It can get rid of potentially 700 Fedora packages. Minimizing the
number of packages needed to be installed as well as being built with.
Is there really no better solution?
Not that we've found. This isn't an off the cuff proposal, it was
months of discussion on mailling lists and off.
To be honest, this is really years in the making. macros and scripts
were tried for years, making them better and better in hopes that it
would ease the problem. When things finally started falling apart, we
really could say we'd tried all we could, but nothing was sustainable.
Can modularity help here? Better packaging macros?
No, and No
How will licensing of dependencies be verified?
Unlike most other languages, nodejs libraries contain a License field
in their package.json.
A simple 'find' script can get the licenses of your bundled packages.
Run that each time you update your package, putting the output in your
License: line of your spec.
What happens when a project adds new dependencies?
Re-run your
bundling script.
You should re-run it every time you do any update, pulling in the
correct and often updated nodejs libraries for your package.
Troy
4:39 a.m.
New subject: Fedora 34 Change: Stop Shipping Individual Nodejs Library
Packages (Self-Contained)
On Wednesday, 09 December 2020 at 21:45, Troy Dawson wrote:
On Wed, Dec 9, 2020 at 11:52 AM James Cassell
<fedoraproject(a)cyberpear.com> wrote:
> On Wed, Dec 9, 2020, at 1:44 PM, Ben Cotton wrote:
> > https://fedoraproject.org/wiki/Changes/NodejsLibrariesBundleByDefault
[...]
> Is there really no better solution?
Not that we've found. This isn't an off the cuff proposal, it was
months of discussion on mailling lists and off.
You say months of discussion, but in reality it's no more than 50
messages between half a dozen people stretching several months, indeed.
I think you should have started the discussion on devel instead of
confining it to nodejs list.
To be honest, this is really years in the making. macros and
scripts
were tried for years, making them better and better in hopes that it
would ease the problem. When things finally started falling apart, we
really could say we'd tried all we could, but nothing was sustainable.
I think it boils down to not having enough packagers, as usual.
Regards,
Dominik
--
Fedora https://getfedora.org | RPM Fusion http://rpmfusion.org
There should be a science of discontent. People need hard times and
oppression to develop psychic muscles.
-- from "Collected Sayings of Muad'Dib" by the Princess Irulan
9:13 a.m.
New subject: Fedora 34 Change: Stop Shipping Individual Nodejs Library
Packages (Self-Contained)
On Thu, Dec 10, 2020 at 5:39 AM Dominik 'Rathann' Mierzejewski
<dominik(a)greysector.net> wrote:
On Wednesday, 09 December 2020 at 21:45, Troy Dawson wrote:
> On Wed, Dec 9, 2020 at 11:52 AM James Cassell
> <fedoraproject(a)cyberpear.com> wrote:
> > On Wed, Dec 9, 2020, at 1:44 PM, Ben Cotton wrote:
> > > https://fedoraproject.org/wiki/Changes/NodejsLibrariesBundleByDefault
[...]
> > Is there really no better solution?
>
> Not that we've found. This isn't an off the cuff proposal, it was
> months of discussion on mailling lists and off.
You say months of discussion, but in reality it's no more than 50
messages between half a dozen people stretching several months, indeed.
I think you should have started the discussion on devel instead of
confining it to nodejs list.
> To be honest, this is really years in the making. macros and scripts
> were tried for years, making them better and better in hopes that it
> would ease the problem. When things finally started falling apart, we
> really could say we'd tried all we could, but nothing was sustainable.
I think it boils down to not having enough packagers, as usual.
Hi Dominik,
It might be the case that with significantly more packagers involved,
and also more scripts and automation, we could do a better job
packaging nodejs libraries.
I am also disappointed that we're unable to package nodejs
applications the "right" way from a distribution's point of view.
However, with dozens if not hundreds of dependencies per package, and
potentially conflicting requirements for versions of libraries, it is
extremely difficult to keep nodejs packages up to date and in sync.
For many years now, most of the nodejs library packages in Fedora have
been effectively unmaintained anyway-- they were stuck on older
versions, because updates would involve creating dozens, if not
hundreds, of new packages and also require updating dozens of *other*
packages. And there is no guarantee that simply updating to the latest
version will work for all dependent packages anyway, so it was
generally not done. (My experience has been that it generally *does*
work despite what the npm metadata claims-- but it doesn't always, and
even when it does, our macros use the npm metadata to create versioned
Requires tags and so packages will need to be updated regardless).
In some sense, nodejs is not that different from other language
ecosystems with their own packaging frameworks, but it's definitely an
extreme outlier in terms of the size and complexity of the dependency
graphs. Further-- unlike some other language ecosystems, I think--
there's frankly little value in Fedora redistributing most nodejs
modules as separate packages. Most of the packages are noarch and
simply install a handful of javascript files into a directory without
actually doing anything to "build" the package, so it's not like we
can enforce a consistent set of build flags or anything like that.
So, from my point of view, the only other thing distribution packaging
might offer at that point is the ability to ship a series of libraries
with a coherent set of versions. But that's almost impossible with
regards to nodejs anyway-- applications will have conflicting
requirements and developers are not going to want to use the versions
of the libraries that we ship.
So what's the point? At some point, it's simply not worth going
through the process to create and maintain hundreds of these packages
in order to ship a single application. It's a huge time sink and
trying to do it has definitely made me, at least, a less motivated and
engaged Fedora contributor in general.
I will also point out that, earlier this year, a large chunk of nodejs
packages were orphaned and no one was particularly interested in
stepping up to take them over. I ended up taking some of them with the
hopes of keeping a few pieces of software alive in the short term, but
then another large chunk of nodejs packages were orphaned, no one took
them, and, frankly, I gave up. If the choices are "we don't package
nodejs software at all" and "we package nodejs software by bundling
all the libraries"... I don't like it either, but the latter option is
better than the former.
Ben Rosser
10:52 p.m.
New subject: Fedora 34 Change: Stop Shipping Individual Nodejs Library
Packages (Self-Contained)
On Thu, Dec 10, 2020 at 3:52 AM James Cassell <fedoraproject(a)cyberpear.com>
wrote:
On Wed, Dec 9, 2020, at 1:44 PM, Ben Cotton wrote:
> https://fedoraproject.org/wiki/Changes/NodejsLibrariesBundleByDefault
Is there really no better solution?
A general comment: I feel it is a shame that more language ecosystems don't
provide source distributions of packages.
The only one I am really aware of is Stackage <https://www.stackage.org/>
for Haskell (about ~2500 compatible packages from Hackage
<https://hackage.haskell.org/>).
I know this is not easy and does not come for free, but I am surprised
there is not more demand for package sets.
It would certainly be a big win for distro packaging.
Jens
5:49 p.m.
New subject: Fedora 34 Change: Stop Shipping Individual Nodejs Library
Packages (Self-Contained)
On 12/9/20 7:44 PM, Ben Cotton wrote:
https://fedoraproject.org/wiki/Changes/NodejsLibrariesBundleByDefault
...
* Policies and guidelines: N/A (not a System Wide Change)
Should there be an update of:
https://docs.fedoraproject.org/en-US/packaging-guidelines/JavaScript/
https://docs.fedoraproject.org/en-US/packaging-guidelines/Node.js/
?
--
Miro Hrončok
--
Phone: +420777974800
IRC: mhroncok
4:04 a.m.
New subject: Fedora 34 Change: Stop Shipping Individual Nodejs Library
Packages (Self-Contained)
On Thursday, 10 December 2020 at 00:49, Miro Hrončok wrote:
On 12/9/20 7:44 PM, Ben Cotton wrote:
> https://fedoraproject.org/wiki/Changes/NodejsLibrariesBundleByDefault
>
> ...
> * Policies and guidelines: N/A (not a System Wide Change)
Should there be an update of:
https://docs.fedoraproject.org/en-US/packaging-guidelines/JavaScript/
https://docs.fedoraproject.org/en-US/packaging-guidelines/Node.js/
?
Same question. I wanted to try packaging web-ext and even started a list
of required dependencies[1]. What do I do now if NodeJS ecosystem is
going away? This feels like a total failure of distro packaging
principles.
[1] https://fedoraproject.org/wiki/Web-ext
Regards,
Dominik
--
Fedora https://getfedora.org | RPM Fusion http://rpmfusion.org
There should be a science of discontent. People need hard times and
oppression to develop psychic muscles.
-- from "Collected Sayings of Muad'Dib" by the Princess Irulan
10:55 a.m.
New subject: Fedora 34 Change: Stop Shipping Individual Nodejs Library
Packages (Self-Contained)
On Thu, Dec 10, 2020 at 2:07 AM Dominik 'Rathann' Mierzejewski
<dominik(a)greysector.net> wrote:
On Thursday, 10 December 2020 at 00:49, Miro Hrončok wrote:
> On 12/9/20 7:44 PM, Ben Cotton wrote:
> > https://fedoraproject.org/wiki/Changes/NodejsLibrariesBundleByDefault
> >
> > ...
> > * Policies and guidelines: N/A (not a System Wide Change)
>
> Should there be an update of:
>
> https://docs.fedoraproject.org/en-US/packaging-guidelines/JavaScript/
> https://docs.fedoraproject.org/en-US/packaging-guidelines/Node.js/
>
> ?
Same question. I wanted to try packaging web-ext and even started a list
of required dependencies[1]. What do I do now if NodeJS ecosystem is
going away? This feels like a total failure of distro packaging
principles.
[1] https://fedoraproject.org/wiki/Web-ext
Regards,
Dominik
You do just what we say, you bundle those nodejs libraries, instead of
using nodejs-<library> packages.
For you, that saves you having to make at least 45 new nodejs library
packages. But, the reality is closer to 500 packages once you add in
all the runtime and build-time dependencies.
If you don't already have one, we have a script that makes the bundling easier.
I've been using this one.
https://github.com/tdawson/tdawson-misc-scripts/tree/master/npm-bundler
It still needs a few tweeks, but it does the bundling part just fine.
I ran that script for web-ext and it took about 10 minutes.
Think of how much time you've already spent looking up what packages
are in Fedora, and how many months it would take to get all the nodejs
library packages made, and reviewed.
It once took me over a year to get a nodejs based package in.
Troy
4:23 a.m.
New subject: Fedora 34 Change: Stop Shipping Individual Nodejs Library
Packages (Self-Contained)
On Thursday, 10 December 2020 at 17:55, Troy Dawson wrote:
On Thu, Dec 10, 2020 at 2:07 AM Dominik 'Rathann'
Mierzejewski
<dominik(a)greysector.net> wrote:
> On Thursday, 10 December 2020 at 00:49, Miro Hrončok wrote:
> > On 12/9/20 7:44 PM, Ben Cotton wrote:
> > > https://fedoraproject.org/wiki/Changes/NodejsLibrariesBundleByDefault
> > >
> > > ...
> > > * Policies and guidelines: N/A (not a System Wide Change)
> >
> > Should there be an update of:
> >
> > https://docs.fedoraproject.org/en-US/packaging-guidelines/JavaScript/
> > https://docs.fedoraproject.org/en-US/packaging-guidelines/Node.js/
> >
> > ?
>
> Same question. I wanted to try packaging web-ext and even started
> a list of required dependencies[1]. What do I do now if NodeJS
> ecosystem is going away? This feels like a total failure of distro
> packaging principles.
>
> [1] https://fedoraproject.org/wiki/Web-ext
You do just what we say, you bundle those nodejs libraries, instead of
using nodejs-<library> packages.
For you, that saves you having to make at least 45 new nodejs library
packages. But, the reality is closer to 500 packages once you add in
all the runtime and build-time dependencies.
That may be so, but it's the right way to go about it.
If you don't already have one, we have a script that makes the
bundling easier. I've been using this one.
https://github.com/tdawson/tdawson-misc-scripts/tree/master/npm-bundler
It still needs a few tweeks, but it does the bundling part just fine.
I ran that script for web-ext and it took about 10 minutes. Think of
how much time you've already spent looking up what packages are in
Fedora, and how many months it would take to get all the nodejs
library packages made, and reviewed.
It once took me over a year to get a nodejs based package in.
Yes, doing things right is sometimes hard and slow. I think it's
acceptable to revert to bundling temporarily, but while that's done,
the NodeJS SIG should go out looking for more members and more
automation to make NodeJS packaging as quick and easy as possible.
Regards,
Dominik
--
Fedora https://getfedora.org | RPM Fusion http://rpmfusion.org
There should be a science of discontent. People need hard times and
oppression to develop psychic muscles.
-- from "Collected Sayings of Muad'Dib" by the Princess Irulan
4:19 p.m.
New subject: Fedora 34 Change: Stop Shipping Individual Nodejs Library
Packages (Self-Contained)
On Wed, Dec 9, 2020 at 3:52 PM Miro Hrončok <mhroncok(a)redhat.com> wrote:
On 12/9/20 7:44 PM, Ben Cotton wrote:
> https://fedoraproject.org/wiki/Changes/NodejsLibrariesBundleByDefault
>
> ...
> * Policies and guidelines: N/A (not a System Wide Change)
Should there be an update of:
https://docs.fedoraproject.org/en-US/packaging-guidelines/JavaScript/
https://docs.fedoraproject.org/en-US/packaging-guidelines/Node.js/
?
Working on the Node.js documentation right now.
I currently haven't tested any of the bundling with javascript
(js-...) packages. So I am not confident in writing documentation for
them.
It looks like there is only 20 left in Fedora. I am thinking of
putting them in on our exceptions list, along with binary nodejs
libraries. So we would get to them at a future time.
Troy
6:08 p.m.
New subject: Fedora 34 Change: Stop Shipping Individual Nodejs Library
Packages (Self-Contained)
On Thu, Dec 17, 2020 at 2:19 PM Troy Dawson <tdawson(a)redhat.com> wrote:
On Wed, Dec 9, 2020 at 3:52 PM Miro Hrončok <mhroncok(a)redhat.com> wrote:
>
> On 12/9/20 7:44 PM, Ben Cotton wrote:
> > https://fedoraproject.org/wiki/Changes/NodejsLibrariesBundleByDefault
> >
> > ...
> > * Policies and guidelines: N/A (not a System Wide Change)
>
> Should there be an update of:
>
> https://docs.fedoraproject.org/en-US/packaging-guidelines/JavaScript/
> https://docs.fedoraproject.org/en-US/packaging-guidelines/Node.js/
>
> ?
>
Working on the Node.js documentation right now.
I currently haven't tested any of the bundling with javascript
(js-...) packages. So I am not confident in writing documentation for
them.
It looks like there is only 20 left in Fedora. I am thinking of
putting them in on our exceptions list, along with binary nodejs
libraries. So we would get to them at a future time.
Troy
The Node.js packaging Guidelines have a pull request for their update.
https://pagure.io/packaging-committee/pull-request/1034
I did not touch the Javascript documentation.
I took another look at the 20 javascript packages. Only two of them
come from nodejs- libraries.
Both of those two look like we can remove the nodejs- runtime package
(server side javascript) and leave the js- runtime package (browser
side javascript).
Troy
5:15 a.m.
New subject: Fedora 34 Change: Stop Shipping Individual Nodejs Library
Packages (Self-Contained)
Hi,
this does not seem to be self-contained, since it seems to affect people
outside the SIG (it states that this is also affecting packages that are
not owned by the SIG).
On Wed, Dec 09, 2020 at 01:44:30PM -0500, Ben Cotton wrote:
https://fedoraproject.org/wiki/Changes/NodejsLibrariesBundleByDefault
== Summary ==
For Nodejs, Fedora should only package:
* The interpreter, development headers/libraries, and the assorted
tools to manage project-level installations (NPM, yarn, etc.).
* Packages that provide binaries that users would want to use in their shell.
* compiled/binary nodejs modules (for now)
== Owner ==
* Name: [[User:tdawson| Troy Dawson]]
* Email: tdawson(a)redhat.com
* Name: [[User:sgallagh| Stephen Gallagher]]
* Email: sgallagh(a)redhat.com
* Name: [[https://developer.fedoraproject.org/tech/languages/nodejs/SIG.html|
Nodejs SIG]]
* Email: nodejs(a)lists.fedoraproject.org
== Detailed Description ==
The nodejs libraries have been approved to be bundled, and there is
infrastructure in place for the bundling to work properly. Currently,
What does this infrastructure look like? How does it help with
addressing security issues in the bundles components effectivly?
it is recommended that packagers should create individual nodejs
library packages instead of bundling all of the libraries into the
package requiring them.
The subject says "Stop Shipping Individual Nodejs Library Packages",
therefore it would be more clear to block all Nodejs libraries in Fedora
instead of only recommending this. Otherwise it will be some half-baked
solution that is probably confusing (Why are some libraries packaged and
others bundled?).
This change is to make it default to bundle the nodejs libraries
with
the package that needs them, and retire the vast majority of nodejs
library packages.
In summary, for Nodejs Fedora should only package:
* The interpreter, development headers/libraries, and the assorted
tools to manage project-level installations (NPM, yarn, etc.).
* Packages that provide binaries that users would want to use in their shell.
* compiled/binary nodejs modules (for now)
This should also include the tooling that is needed to manage the
bundling.
== Feedback ==
There has been a discussion on the fedora nodejs mailing list about
what to do with the extreme dependency problem of the nodejs library
packages. Because of the extreme inter-dependency, upgrading almost
any package causes others to break. It has caused most packages to
rot, remaining on unsupported versions for years. Many of the nodejs
packagers are giving up and orphaning their packages, which has caused
even more problems.
An initial proposal was to find all of the important nodejs library
packages and bundle those, making them easier to upgrade and maintain.
But there was problems with figuring out what was important, and what
versions should those have. During that discussion, this rather
extreme solution of getting rid of all nodejs libraries was proposed.
To our surprise, it has been the best received suggestion and fixes
the most problems.
What problems remain?
== Benefit to Fedora ==
* In Fedora 33, there are many nodejs libraries that are
uninstallable, thus causing other programs based off them to also be
uninstallable. This gets rid of that problem.
* Packages in Fedora that use nodejs libraries will be able to use the
library versions that upstream has tested and approved.
* If a package in Fedora uses a nodejs library, the packager will not
have to also package extra individual nodejs library packages. There
have been times this has led to over 100 extra packages, each with
their own package reviews and maintenance problems. This change will
lower the workload on that packager, and possibly get more packages
into Fedora.
* The nodejs maintainers can concentrate on nodejs itself, instead of
the whole nodejs library infrastructure.
* Nodejs developers using Fedora will no longer have to worry about
Fedora's global nodejs libraries causing conflicts or inconsistencies.
== Scope ==
* Proposal owners:
We will go through the Fedora release and determine what nodejs
packages Fedora should package. We will implement nodejs library
bundling on those we already own. For those that we do not own, we
will work with their owners to implement nodejs library bundling.
What about future packagers? How will they learn/be enabled to do it the
right way?
As packages implement nodejs library bundling, we will monitor the
nodejs libraries and note which ones are no longer required. When
they are no longer required, we will retire them, if we own them. If
we do not own them, we will work with the owners to retire them, if
they wish.
* Other developers:
For Fedora packagers whose package rely on nodejs libraries, please
contact the [[https://developer.fedoraproject.org/tech/languages/nodejs/SIG.html|
Nodejs SIG]] and we will help you find the easiest way to bundle your
nodejs libraries.
For Fedora nodejs library packages, look to see what depends on your
library. If it looks like you can do so, retire your nodejs library.
If you would like, give the
[[https://developer.fedoraproject.org/tech/languages/nodejs/SIG.html|
Nodejs SIG]] admin to your nodejs libraries, and they will work
through the process for you.
* Release engineering: [https://pagure.io/releng/issues #Releng issue
number] (a check of an impact with Release Engineering is needed)
* Policies and guidelines: N/A (not a System Wide Change)
* Trademark approval: N/A (not needed for this Change)
* Alignment with Objectives:
== Upgrade/compatibility impact ==
N/A
== How To Test ==
* Install all nodejs libraries in Fedora 33. Try to update to Fedora 34.
* Try to install all packages that require nodejs in Fedora 34.
* Install all packages that require nodejs in Fedora 33. Try to
update to Fedora 34.
What are the recommended commands to do the testing?
== User Experience ==
non-developer end users should not see anything different. Their
nodejs binaries should continue to work.
Nodejs developers using Fedora will no longer have to worry about
Fedora's global nodejs libraries causing conflicts or inconsistencies.
== Dependencies ==
As nodejs library packages are removed, we will work with the various
packages that depend on them. We will help them bundle their nodejs
libraries.
== Contingency Plan ==
Since we will be bundling the nodejs binaries, before we remove their
current dependencies, we will simply stop where we are at the freeze.
There will be nothing to back out.
* Contingency mechanism: N/A
* Contingency deadline: N/A
* Blocks release? N/A
* Blocks product? N/A
== Documentation ==
N/A (not a System Wide Change)
This new rule should be properly documented for packagers.
Thanks
Till
11:32 a.m.
New subject: Fedora 34 Change: Stop Shipping Individual Nodejs Library
Packages (Self-Contained)
On Fri, Dec 11, 2020 at 3:18 AM Till Maas <opensource(a)till.name> wrote:
Hi,
this does not seem to be self-contained, since it seems to affect people
outside the SIG (it states that this is also affecting packages that are
not owned by the SIG).
On Wed, Dec 09, 2020 at 01:44:30PM -0500, Ben Cotton wrote:
> https://fedoraproject.org/wiki/Changes/NodejsLibrariesBundleByDefault
>
> == Summary ==
>
> For Nodejs, Fedora should only package:
> * The interpreter, development headers/libraries, and the assorted
> tools to manage project-level installations (NPM, yarn, etc.).
> * Packages that provide binaries that users would want to use in their shell.
> * compiled/binary nodejs modules (for now)
>
> == Owner ==
>
> * Name: [[User:tdawson| Troy Dawson]]
> * Email: tdawson(a)redhat.com
> * Name: [[User:sgallagh| Stephen Gallagher]]
> * Email: sgallagh(a)redhat.com
> * Name: [[https://developer.fedoraproject.org/tech/languages/nodejs/SIG.html|
> Nodejs SIG]]
> * Email: nodejs(a)lists.fedoraproject.org
>
>
> == Detailed Description ==
>
> The nodejs libraries have been approved to be bundled, and there is
> infrastructure in place for the bundling to work properly. Currently,
What does this infrastructure look like? How does it help with
addressing security issues in the bundles components effectivly?
> it is recommended that packagers should create individual nodejs
> library packages instead of bundling all of the libraries into the
> package requiring them.
The subject says "Stop Shipping Individual Nodejs Library Packages",
therefore it would be more clear to block all Nodejs libraries in Fedora
instead of only recommending this. Otherwise it will be some half-baked
solution that is probably confusing (Why are some libraries packaged and
others bundled?).
> This change is to make it default to bundle the nodejs libraries with
> the package that needs them, and retire the vast majority of nodejs
> library packages.
> In summary, for Nodejs Fedora should only package:
> * The interpreter, development headers/libraries, and the assorted
> tools to manage project-level installations (NPM, yarn, etc.).
> * Packages that provide binaries that users would want to use in their shell.
> * compiled/binary nodejs modules (for now)
This should also include the tooling that is needed to manage the
bundling.
> == Feedback ==
>
> There has been a discussion on the fedora nodejs mailing list about
> what to do with the extreme dependency problem of the nodejs library
> packages. Because of the extreme inter-dependency, upgrading almost
> any package causes others to break. It has caused most packages to
> rot, remaining on unsupported versions for years. Many of the nodejs
> packagers are giving up and orphaning their packages, which has caused
> even more problems.
>
> An initial proposal was to find all of the important nodejs library
> packages and bundle those, making them easier to upgrade and maintain.
> But there was problems with figuring out what was important, and what
> versions should those have. During that discussion, this rather
> extreme solution of getting rid of all nodejs libraries was proposed.
> To our surprise, it has been the best received suggestion and fixes
> the most problems.
What problems remain?
>
> == Benefit to Fedora ==
>
> * In Fedora 33, there are many nodejs libraries that are
> uninstallable, thus causing other programs based off them to also be
> uninstallable. This gets rid of that problem.
> * Packages in Fedora that use nodejs libraries will be able to use the
> library versions that upstream has tested and approved.
> * If a package in Fedora uses a nodejs library, the packager will not
> have to also package extra individual nodejs library packages. There
> have been times this has led to over 100 extra packages, each with
> their own package reviews and maintenance problems. This change will
> lower the workload on that packager, and possibly get more packages
> into Fedora.
> * The nodejs maintainers can concentrate on nodejs itself, instead of
> the whole nodejs library infrastructure.
> * Nodejs developers using Fedora will no longer have to worry about
> Fedora's global nodejs libraries causing conflicts or inconsistencies.
>
> == Scope ==
> * Proposal owners:
> We will go through the Fedora release and determine what nodejs
> packages Fedora should package. We will implement nodejs library
> bundling on those we already own. For those that we do not own, we
> will work with their owners to implement nodejs library bundling.
What about future packagers? How will they learn/be enabled to do it the
right way?
> As packages implement nodejs library bundling, we will monitor the
> nodejs libraries and note which ones are no longer required. When
> they are no longer required, we will retire them, if we own them. If
> we do not own them, we will work with the owners to retire them, if
> they wish.
>
> * Other developers:
> For Fedora packagers whose package rely on nodejs libraries, please
> contact the [[https://developer.fedoraproject.org/tech/languages/nodejs/SIG.html|
> Nodejs SIG]] and we will help you find the easiest way to bundle your
> nodejs libraries.
>
> For Fedora nodejs library packages, look to see what depends on your
> library. If it looks like you can do so, retire your nodejs library.
> If you would like, give the
> [[https://developer.fedoraproject.org/tech/languages/nodejs/SIG.html|
> Nodejs SIG]] admin to your nodejs libraries, and they will work
> through the process for you.
>
> * Release engineering: [https://pagure.io/releng/issues #Releng issue
> number] (a check of an impact with Release Engineering is needed)
> * Policies and guidelines: N/A (not a System Wide Change)
> * Trademark approval: N/A (not needed for this Change)
> * Alignment with Objectives:
>
>
> == Upgrade/compatibility impact ==
> N/A
>
>
> == How To Test ==
>
> * Install all nodejs libraries in Fedora 33. Try to update to Fedora 34.
> * Try to install all packages that require nodejs in Fedora 34.
> * Install all packages that require nodejs in Fedora 33. Try to
> update to Fedora 34.
What are the recommended commands to do the testing?
> == User Experience ==
> non-developer end users should not see anything different. Their
> nodejs binaries should continue to work.
>
> Nodejs developers using Fedora will no longer have to worry about
> Fedora's global nodejs libraries causing conflicts or inconsistencies.
>
>
> == Dependencies ==
> As nodejs library packages are removed, we will work with the various
> packages that depend on them. We will help them bundle their nodejs
> libraries.
>
>
> == Contingency Plan ==
> Since we will be bundling the nodejs binaries, before we remove their
> current dependencies, we will simply stop where we are at the freeze.
> There will be nothing to back out.
>
> * Contingency mechanism: N/A
> * Contingency deadline: N/A
> * Blocks release? N/A
> * Blocks product? N/A
>
> == Documentation ==
> N/A (not a System Wide Change)
This new rule should be properly documented for packagers.
Thanks
Till
I agree with you on all your points of documentation.
This needs to be documented better, including notes for new packagers,
and have example scripts.
And the Documentation section needs to point to that documentation.
I am working on this right now.
Troy
6:03 p.m.
New subject: Fedora 34 Change: Stop Shipping Individual Nodejs Library
Packages (Self-Contained)
On Fri, Dec 11, 2020 at 9:32 AM Troy Dawson <tdawson(a)redhat.com> wrote:
On Fri, Dec 11, 2020 at 3:18 AM Till Maas <opensource(a)till.name> wrote:
>
> Hi,
>
> this does not seem to be self-contained, since it seems to affect people
> outside the SIG (it states that this is also affecting packages that are
> not owned by the SIG).
>
> On Wed, Dec 09, 2020 at 01:44:30PM -0500, Ben Cotton wrote:
> > https://fedoraproject.org/wiki/Changes/NodejsLibrariesBundleByDefault
> >
> > == Summary ==
> >
> > For Nodejs, Fedora should only package:
> > * The interpreter, development headers/libraries, and the assorted
> > tools to manage project-level installations (NPM, yarn, etc.).
> > * Packages that provide binaries that users would want to use in their shell.
> > * compiled/binary nodejs modules (for now)
> >
> > == Owner ==
> >
> > * Name: [[User:tdawson| Troy Dawson]]
> > * Email: tdawson(a)redhat.com
> > * Name: [[User:sgallagh| Stephen Gallagher]]
> > * Email: sgallagh(a)redhat.com
> > * Name: [[https://developer.fedoraproject.org/tech/languages/nodejs/SIG.html|
> > Nodejs SIG]]
> > * Email: nodejs(a)lists.fedoraproject.org
> >
> >
> > == Detailed Description ==
> >
> > The nodejs libraries have been approved to be bundled, and there is
> > infrastructure in place for the bundling to work properly. Currently,
>
> What does this infrastructure look like? How does it help with
> addressing security issues in the bundles components effectivly?
>
> > it is recommended that packagers should create individual nodejs
> > library packages instead of bundling all of the libraries into the
> > package requiring them.
>
> The subject says "Stop Shipping Individual Nodejs Library Packages",
> therefore it would be more clear to block all Nodejs libraries in Fedora
> instead of only recommending this. Otherwise it will be some half-baked
> solution that is probably confusing (Why are some libraries packaged and
> others bundled?).
>
> > This change is to make it default to bundle the nodejs libraries with
> > the package that needs them, and retire the vast majority of nodejs
> > library packages.
> > In summary, for Nodejs Fedora should only package:
> > * The interpreter, development headers/libraries, and the assorted
> > tools to manage project-level installations (NPM, yarn, etc.).
> > * Packages that provide binaries that users would want to use in their shell.
> > * compiled/binary nodejs modules (for now)
>
> This should also include the tooling that is needed to manage the
> bundling.
>
>
> > == Feedback ==
> >
> > There has been a discussion on the fedora nodejs mailing list about
> > what to do with the extreme dependency problem of the nodejs library
> > packages. Because of the extreme inter-dependency, upgrading almost
> > any package causes others to break. It has caused most packages to
> > rot, remaining on unsupported versions for years. Many of the nodejs
> > packagers are giving up and orphaning their packages, which has caused
> > even more problems.
> >
> > An initial proposal was to find all of the important nodejs library
> > packages and bundle those, making them easier to upgrade and maintain.
> > But there was problems with figuring out what was important, and what
> > versions should those have. During that discussion, this rather
> > extreme solution of getting rid of all nodejs libraries was proposed.
> > To our surprise, it has been the best received suggestion and fixes
> > the most problems.
>
> What problems remain?
>
> >
> > == Benefit to Fedora ==
> >
> > * In Fedora 33, there are many nodejs libraries that are
> > uninstallable, thus causing other programs based off them to also be
> > uninstallable. This gets rid of that problem.
> > * Packages in Fedora that use nodejs libraries will be able to use the
> > library versions that upstream has tested and approved.
> > * If a package in Fedora uses a nodejs library, the packager will not
> > have to also package extra individual nodejs library packages. There
> > have been times this has led to over 100 extra packages, each with
> > their own package reviews and maintenance problems. This change will
> > lower the workload on that packager, and possibly get more packages
> > into Fedora.
> > * The nodejs maintainers can concentrate on nodejs itself, instead of
> > the whole nodejs library infrastructure.
> > * Nodejs developers using Fedora will no longer have to worry about
> > Fedora's global nodejs libraries causing conflicts or inconsistencies.
> >
> > == Scope ==
> > * Proposal owners:
> > We will go through the Fedora release and determine what nodejs
> > packages Fedora should package. We will implement nodejs library
> > bundling on those we already own. For those that we do not own, we
> > will work with their owners to implement nodejs library bundling.
>
> What about future packagers? How will they learn/be enabled to do it the
> right way?
>
> > As packages implement nodejs library bundling, we will monitor the
> > nodejs libraries and note which ones are no longer required. When
> > they are no longer required, we will retire them, if we own them. If
> > we do not own them, we will work with the owners to retire them, if
> > they wish.
> >
> > * Other developers:
> > For Fedora packagers whose package rely on nodejs libraries, please
> > contact the
[[https://developer.fedoraproject.org/tech/languages/nodejs/SIG.html|
> > Nodejs SIG]] and we will help you find the easiest way to bundle your
> > nodejs libraries.
> >
> > For Fedora nodejs library packages, look to see what depends on your
> > library. If it looks like you can do so, retire your nodejs library.
> > If you would like, give the
> > [[https://developer.fedoraproject.org/tech/languages/nodejs/SIG.html|
> > Nodejs SIG]] admin to your nodejs libraries, and they will work
> > through the process for you.
> >
> > * Release engineering: [https://pagure.io/releng/issues #Releng issue
> > number] (a check of an impact with Release Engineering is needed)
> > * Policies and guidelines: N/A (not a System Wide Change)
> > * Trademark approval: N/A (not needed for this Change)
> > * Alignment with Objectives:
> >
> >
> > == Upgrade/compatibility impact ==
> > N/A
> >
> >
> > == How To Test ==
> >
> > * Install all nodejs libraries in Fedora 33. Try to update to Fedora 34.
> > * Try to install all packages that require nodejs in Fedora 34.
> > * Install all packages that require nodejs in Fedora 33. Try to
> > update to Fedora 34.
>
> What are the recommended commands to do the testing?
>
> > == User Experience ==
> > non-developer end users should not see anything different. Their
> > nodejs binaries should continue to work.
> >
> > Nodejs developers using Fedora will no longer have to worry about
> > Fedora's global nodejs libraries causing conflicts or inconsistencies.
> >
> >
> > == Dependencies ==
> > As nodejs library packages are removed, we will work with the various
> > packages that depend on them. We will help them bundle their nodejs
> > libraries.
> >
> >
> > == Contingency Plan ==
> > Since we will be bundling the nodejs binaries, before we remove their
> > current dependencies, we will simply stop where we are at the freeze.
> > There will be nothing to back out.
> >
> > * Contingency mechanism: N/A
> > * Contingency deadline: N/A
> > * Blocks release? N/A
> > * Blocks product? N/A
> >
> > == Documentation ==
> > N/A (not a System Wide Change)
>
> This new rule should be properly documented for packagers.
>
> Thanks
> Till
I agree with you on all your points of documentation.
This needs to be documented better, including notes for new packagers,
and have example scripts.
And the Documentation section needs to point to that documentation.
I am working on this right now.
Troy
Sorry this took so long.
A pull request has been created to update the Node.js Packaging Guidelines.
https://pagure.io/packaging-committee/pull-request/1034
Documentation section has been updated to point to the Packaging
Guidelines, along with the pull request.
Troy
1:35 p.m.
New subject: Fedora 34 Change: Stop Shipping Individual Nodejs Library
Packages (Self-Contained)
On 09.12.2020 19:44, Ben Cotton wrote:
The nodejs libraries have been approved to be bundled, and there is
infrastructure in place for the bundling to work properly.
And what about adding Provides: bundled(nodejs-foo) = version? There
were many nodejs packages with backdoors in npm. That's why versions
need to be tracked.
I think Fedora can reuse the flatpak-node-generator from Flatpak:
https://github.com/flatpak/flatpak-builder-tools/tree/master/node
--
Sincerely,
Vitaly Zaitsev (vitaly(a)easycoding.org)
4:40 a.m.
New subject: Fedora 34 Change: Stop Shipping Individual Nodejs Library
Packages (Self-Contained)
On 12/9/20 7:44 PM, Ben Cotton wrote:
== Scope ==
* Proposal owners:
We will go through the Fedora release and determine what nodejs
packages Fedora should package. We will implement nodejs library
bundling on those we already own. For those that we do not own, we
will work with their owners to implement nodejs library bundling.
As packages implement nodejs library bundling, we will monitor the
nodejs libraries and note which ones are no longer required. When
they are no longer required, we will retire them, if we own them. If
we do not own them, we will work with the owners to retire them, if
they wish.
* Other developers:
For Fedora packagers whose package rely on nodejs libraries, please
contact the [[https://developer.fedoraproject.org/tech/languages/nodejs/SIG.html|
Nodejs SIG]] and we will help you find the easiest way to bundle your
nodejs libraries.
For Fedora nodejs library packages, look to see what depends on your
library. If it looks like you can do so, retire your nodejs library.
If you would like, give the
[[https://developer.fedoraproject.org/tech/languages/nodejs/SIG.html|
Nodejs SIG]] admin to your nodejs libraries, and they will work
through the process for you.
I thought about this a bit more and I would really appreciate to see at least
some preliminary list of packages that will be retired/removed (completely fine
if it's defined as "all nodejs-* packages except subpackages of nodejs itself
and nodejs-packaging") and the *list of dependent packages that are impacted by
this change*.
I've done some preliminary check with:
https://pagure.io/releng/blob/master/f/scripts/find_unblocked_orphans.py
$ python find_unblocked_orphans.py --skip-orphans $(repoquery
--repo=rawhide-source -a | pkgname | grep ^nodejs- | grep -v ^nodejs-packaging$
| sort | uniq)
...
The following packages require above mentioned packages:
Depending on: nodejs-backbone (2), status change: 2017-08-04 (175 weeks ago)
beets (maintained by: maha, mbaldessari)
beets-plugins-1.4.9-8.fc33.noarch requires js-backbone = 1.3.3-10.fc34
python-notebook (maintained by: churchyard, python-sig)
python3-notebook-6.1.4-1.fc34.noarch requires js-backbone = 1.3.3-10.fc34
Depending on: nodejs-generic-pool (1), status change: 2020-08-24 (16 weeks ago)
statsd (maintained by: noodles, piotrp)
statsd-0.8.6-1.fc34.noarch requires npm(generic-pool) = 2.2.2
Depending on: nodejs-shelljs (1), status change: 2020-05-13 (31 weeks ago)
notepadqq (maintained by: orphan)
notepadqq-1.4.8-13.fc33.x86_64 requires nodejs-shelljs = 0.8.4-2.fc33
Depending on: nodejs-typescript (1), status change: 2020-11-22 (3 weeks ago)
gnome-shell-extension-pop-shell (maintained by: carlwgeorge, dustymabe)
gnome-shell-extension-pop-shell-1.0.0-3.20201130gitee943b8.fc34.src requires
npm(typescript) = 4.0.2
Depending on: nodejs-underscore (11), status change: 2020-05-13 (31 weeks ago)
R-V8 (maintained by: qulogic)
R-V8-3.4.0-1.fc34.src requires js-underscore = 1.10.2-3.fc34
R-V8-3.4.0-1.fc34.x86_64 requires js-underscore = 1.10.2-3.fc34
beets (maintained by: maha, mbaldessari)
beets-plugins-1.4.9-8.fc33.noarch requires js-underscore = 1.10.2-3.fc34
coffee-script (maintained by: jsmith, nodejs-sig, patches, vjancik)
coffee-script-1.10.0-14.fc33.src requires npm(underscore) = 1.10.2
python-f5-sdk (maintained by: xavierb)
python-f5-sdk-3.0.21-7.fc33.src requires js-underscore = 1.10.2-3.fc34
python-f5-sdk-doc-3.0.21-7.fc33.noarch requires js-underscore = 1.10.2-3.fc34
python-h2 (maintained by: eclipseo, python-sig)
python-h2-4.0.0-1.fc34.src requires js-underscore = 1.10.2-3.fc34
python-h2-doc-4.0.0-1.fc34.noarch requires js-underscore = 1.10.2-3.fc34
python-hyperlink (maintained by: eclipseo, python-sig)
python-hyperlink-20.0.1-1.fc34.src requires js-underscore = 1.10.2-3.fc34
python-hyperlink-doc-20.0.1-1.fc34.noarch requires js-underscore = 1.10.2-3.fc34
python-notebook (maintained by: churchyard, python-sig)
python3-notebook-6.1.4-1.fc34.noarch requires js-underscore = 1.10.2-3.fc34
perl-Mojolicious-Plugin-AssetPack (maintained by: eseyman)
perl-Mojolicious-Plugin-AssetPack-2.10-1.fc34.src requires coffee-script =
1.10.0-14.fc33
python-webassets (maintained by: dcallagh, kumarpraveen, pjp, sundaram)
python-webassets-0.12.1-18.fc34.src requires /usr/bin/coffee
vim-syntastic (maintained by: praiskup)
vim-syntastic-coffee-3.10.0-7.fc33.noarch requires coffee-script = 1.10.0-14.fc33
openqa (maintained by: adamwill)
openqa-4.6-59.20201103git91baf79.fc34.noarch requires
perl(Mojolicious::Plugin::AssetPack) = 2.10,
perl(Mojolicious::Plugin::AssetPack::Util)
openqa-4.6-59.20201103git91baf79.fc34.src requires
perl(Mojolicious::Plugin::AssetPack) = 2.10
openqa-common-4.6-59.20201103git91baf79.fc34.noarch requires
perl(Mojolicious::Plugin::AssetPack) = 2.10
openqa-devel-4.6-59.20201103git91baf79.fc34.noarch requires
perl(Mojolicious::Plugin::AssetPack) = 2.10
...
Is this any accurate?
--
Miro Hrončok
--
Phone: +420777974800
IRC: mhroncok
8:28 a.m.
New subject: Fedora 34 Change: Stop Shipping Individual Nodejs Library
Packages (Self-Contained)
On Wed, Dec 16, 2020 at 2:45 AM Miro Hrončok <mhroncok(a)redhat.com> wrote:
On 12/9/20 7:44 PM, Ben Cotton wrote:
> == Scope ==
> * Proposal owners:
> We will go through the Fedora release and determine what nodejs
> packages Fedora should package. We will implement nodejs library
> bundling on those we already own. For those that we do not own, we
> will work with their owners to implement nodejs library bundling.
>
> As packages implement nodejs library bundling, we will monitor the
> nodejs libraries and note which ones are no longer required. When
> they are no longer required, we will retire them, if we own them. If
> we do not own them, we will work with the owners to retire them, if
> they wish.
>
> * Other developers:
> For Fedora packagers whose package rely on nodejs libraries, please
> contact the [[https://developer.fedoraproject.org/tech/languages/nodejs/SIG.html|
> Nodejs SIG]] and we will help you find the easiest way to bundle your
> nodejs libraries.
>
> For Fedora nodejs library packages, look to see what depends on your
> library. If it looks like you can do so, retire your nodejs library.
> If you would like, give the
> [[https://developer.fedoraproject.org/tech/languages/nodejs/SIG.html|
> Nodejs SIG]] admin to your nodejs libraries, and they will work
> through the process for you.
I thought about this a bit more and I would really appreciate to see at least
some preliminary list of packages that will be retired/removed (completely fine
if it's defined as "all nodejs-* packages except subpackages of nodejs itself
and nodejs-packaging") and the *list of dependent packages that are impacted by
this change*.
I've done some preliminary check with:
https://pagure.io/releng/blob/master/f/scripts/find_unblocked_orphans.py
$ python find_unblocked_orphans.py --skip-orphans $(repoquery
--repo=rawhide-source -a | pkgname | grep ^nodejs- | grep -v ^nodejs-packaging$
| sort | uniq)
...
The following packages require above mentioned packages:
Depending on: nodejs-backbone (2), status change: 2017-08-04 (175 weeks ago)
beets (maintained by: maha, mbaldessari)
beets-plugins-1.4.9-8.fc33.noarch requires js-backbone = 1.3.3-10.fc34
python-notebook (maintained by: churchyard, python-sig)
python3-notebook-6.1.4-1.fc34.noarch requires js-backbone =
1.3.3-10.fc34
Depending on: nodejs-generic-pool (1), status change: 2020-08-24 (16 weeks ago)
statsd (maintained by: noodles, piotrp)
statsd-0.8.6-1.fc34.noarch requires npm(generic-pool) = 2.2.2
Depending on: nodejs-shelljs (1), status change: 2020-05-13 (31 weeks ago)
notepadqq (maintained by: orphan)
notepadqq-1.4.8-13.fc33.x86_64 requires nodejs-shelljs = 0.8.4-2.fc33
Depending on: nodejs-typescript (1), status change: 2020-11-22 (3 weeks ago)
gnome-shell-extension-pop-shell (maintained by: carlwgeorge, dustymabe)
gnome-shell-extension-pop-shell-1.0.0-3.20201130gitee943b8.fc34.src
requires
npm(typescript) = 4.0.2
Depending on: nodejs-underscore (11), status change: 2020-05-13 (31 weeks ago)
R-V8 (maintained by: qulogic)
R-V8-3.4.0-1.fc34.src requires js-underscore = 1.10.2-3.fc34
R-V8-3.4.0-1.fc34.x86_64 requires js-underscore = 1.10.2-3.fc34
beets (maintained by: maha, mbaldessari)
beets-plugins-1.4.9-8.fc33.noarch requires js-underscore = 1.10.2-3.fc34
coffee-script (maintained by: jsmith, nodejs-sig, patches, vjancik)
coffee-script-1.10.0-14.fc33.src requires npm(underscore) = 1.10.2
python-f5-sdk (maintained by: xavierb)
python-f5-sdk-3.0.21-7.fc33.src requires js-underscore = 1.10.2-3.fc34
python-f5-sdk-doc-3.0.21-7.fc33.noarch requires js-underscore =
1.10.2-3.fc34
python-h2 (maintained by: eclipseo, python-sig)
python-h2-4.0.0-1.fc34.src requires js-underscore = 1.10.2-3.fc34
python-h2-doc-4.0.0-1.fc34.noarch requires js-underscore = 1.10.2-3.fc34
python-hyperlink (maintained by: eclipseo, python-sig)
python-hyperlink-20.0.1-1.fc34.src requires js-underscore =
1.10.2-3.fc34
python-hyperlink-doc-20.0.1-1.fc34.noarch requires js-underscore =
1.10.2-3.fc34
python-notebook (maintained by: churchyard, python-sig)
python3-notebook-6.1.4-1.fc34.noarch requires js-underscore =
1.10.2-3.fc34
perl-Mojolicious-Plugin-AssetPack (maintained by: eseyman)
perl-Mojolicious-Plugin-AssetPack-2.10-1.fc34.src requires coffee-script
=
1.10.0-14.fc33
python-webassets (maintained by: dcallagh, kumarpraveen, pjp, sundaram)
python-webassets-0.12.1-18.fc34.src requires /usr/bin/coffee
vim-syntastic (maintained by: praiskup)
vim-syntastic-coffee-3.10.0-7.fc33.noarch requires coffee-script =
1.10.0-14.fc33
openqa (maintained by: adamwill)
openqa-4.6-59.20201103git91baf79.fc34.noarch requires
perl(Mojolicious::Plugin::AssetPack) = 2.10,
perl(Mojolicious::Plugin::AssetPack::Util)
openqa-4.6-59.20201103git91baf79.fc34.src requires
perl(Mojolicious::Plugin::AssetPack) = 2.10
openqa-common-4.6-59.20201103git91baf79.fc34.noarch requires
perl(Mojolicious::Plugin::AssetPack) = 2.10
openqa-devel-4.6-59.20201103git91baf79.fc34.noarch requires
perl(Mojolicious::Plugin::AssetPack) = 2.10
...
Is this any accurate?
We plan on only removing nodejs library leaves (packages that nothing
depends on for running or building).
I've never ran that script looking for packages that nothing depends
on, and I'm not sure I'm looking at the output correctly.
Would I look at the "FTBFS (rawhide) (not depended on) (740):"
section? Are those the leaves?
Anyway, there would be some variation on what you have there, if that
is correct. It would be more ...
dnf repoquery --qf="%{source_name}" -a | grep ^nodejs- | grep -v
^nodejs-packaging% | sort -u -o nodejs.sources
vi nodejs.sources # remove the non-noarch packages, any any others we need to
python3 find_unblocked_orphans.py --skip-orphans $(cat nodejs.sources)
Troy
9:24 a.m.
New subject: Fedora 34 Change: Stop Shipping Individual Nodejs Library
Packages (Self-Contained)
On 12/18/20 3:28 PM, Troy Dawson wrote:
We plan on only removing nodejs library leaves (packages that
nothing
depends on for running or building).
Thanks. That was not obvious from the proposal.
I've never ran that script looking for packages that nothing
depends
on, and I'm not sure I'm looking at the output correctly.
Would I look at the "FTBFS (rawhide) (not depended on) (740):"
section? Are those the leaves?
Either leaves or only needed by other leaves. If you remove the entire group at
once, there *should* be no impact outside of that group (however, conditional
requirements are not handled in a 100 % bulletproof way).
Anyway, there would be some variation on what you have there, if
that
is correct. It would be more ...
dnf repoquery --qf="%{source_name}" -a | grep ^nodejs- | grep -v
^nodejs-packaging% | sort -u -o nodejs.sources
vi nodejs.sources # remove the non-noarch packages, any any others we need to
python3 find_unblocked_orphans.py --skip-orphans $(cat nodejs.sources)
Just curious: Do you have some example of non-noarch nodejs package? I struggled
to find one:
$ repoquery --repo=koji -a | grep nodejs | grep -v noarch
nodejs-1:14.15.1-1.fc34.x86_64
nodejs-devel-1:14.15.1-1.fc34.x86_64
nodejs-full-i18n-1:14.15.1-1.fc34.x86_64
nodejs-libs-1:14.15.1-1.fc34.x86_64
(All 4 are subpackages of nodejs itself.)
--
Miro Hrončok
--
Phone: +420777974800
IRC: mhroncok
9:36 a.m.
New subject: Fedora 34 Change: Stop Shipping Individual Nodejs Library
Packages (Self-Contained)
On Sun, Dec 20, 2020 at 3:24 PM Miro Hrončok <mhroncok(a)redhat.com> wrote:
On 12/18/20 3:28 PM, Troy Dawson wrote:
> We plan on only removing nodejs library leaves (packages that nothing
> depends on for running or building).
Thanks. That was not obvious from the proposal.
> I've never ran that script looking for packages that nothing depends
> on, and I'm not sure I'm looking at the output correctly.
> Would I look at the "FTBFS (rawhide) (not depended on) (740):"
> section? Are those the leaves?
Either leaves or only needed by other leaves. If you remove the entire group at
once, there *should* be no impact outside of that group (however, conditional
requirements are not handled in a 100 % bulletproof way).
> Anyway, there would be some variation on what you have there, if that
> is correct. It would be more ...
>
> dnf repoquery --qf="%{source_name}" -a | grep ^nodejs- | grep -v
> ^nodejs-packaging% | sort -u -o nodejs.sources
> vi nodejs.sources # remove the non-noarch packages, any any others we need to
> python3 find_unblocked_orphans.py --skip-orphans $(cat nodejs.sources)
Just curious: Do you have some example of non-noarch nodejs package? I struggled
to find one:
nodejs-bcrypt
10 a.m.
New subject: Fedora 34 Change: Stop Shipping Individual Nodejs Library
Packages (Self-Contained)
On 12/20/20 4:36 PM, Peter Robinson wrote:
>> Anyway, there would be some variation on what you have there,
if that
>> is correct. It would be more ...
>>
>> dnf repoquery --qf="%{source_name}" -a | grep ^nodejs- | grep -v
>> ^nodejs-packaging% | sort -u -o nodejs.sources
>> vi nodejs.sources # remove the non-noarch packages, any any others we need to
>> python3 find_unblocked_orphans.py --skip-orphans $(cat nodejs.sources)
>
> Just curious: Do you have some example of non-noarch nodejs package? I struggled
> to find one:
nodejs-bcrypt
Is already retired:
https://src.fedoraproject.org/rpms/nodejs-bcrypt/c/2ba645fe82af5e39c16c22...
--
Miro Hrončok
--
Phone: +420777974800
IRC: mhroncok
1223
days inactive
1234
days old
24 comments
10 participants
participants (10)
-
Ben Cotton -
Ben Rosser -
Dominik 'Rathann' Mierzejewski -
James Cassell -
Jens-Ulrik Petersen -
Miro Hrončok -
Peter Robinson -
Till Maas -
Troy Dawson -
Vitaly Zaitsev