Bundling 1.8 GB of nodejs dependencies

[Andreas Gerstmayr]

Hi!

[starting a new thread, I guess my last reply to another thread got lost]

I'm one of the maintainers of Grafana in Fedora.

Latest Grafana has:

$ du -sch node_modules
1.8G	node_modules

Some of the largest dependencies:

$ du -d 1 -am node_modules | sort -n -r | head -n 20
1760	node_modules
291	node_modules/@storybook
85	node_modules/@babel
73	node_modules/monaco-editor
66	node_modules/@types
58	node_modules/@microsoft
55	node_modules/typescript
43	node_modules/@jest
38	node_modules/@svgr
29	node_modules/jest
28	node_modules/@antv
26	node_modules/jest-runtime
23	node_modules/react-icons
21	node_modules/cypress
19	node_modules/react-dev-utils
19	node_modules/less
19	node_modules/@icons
19	node_modules/concurrently
18	node_modules/rxjs
18	node_modules/listr

$ ls node_modules | wc -l
2022

Compressing the node_modules folder using zstd:
default level: 183 MB
zstd level 19: 111 MB

How can/should we bundle that? Is this size acceptable for a SRPM?

Bundling it would allow us to build the frontend and run the frontend 
tests as part of the spec, and we can apply patches properly (without 
(re)generating anything locally). Most of the patches at least, in case 
some security patch requires an upgrade of a npm dependency, we also 
need to recreate the vendor tarball.


Cheers,
Andreas

[Neal Gompa]

On Thu, Oct 1, 2020 at 12:50 PM Andreas Gerstmayr <agerstmayr(a)redhat.com&gt; wrote:
>  Hi!
>
>  [starting a new thread, I guess my last reply to another thread got lost]
>
>  I'm one of the maintainers of Grafana in Fedora.
>
>  Latest Grafana has:
>
>  $ du -sch node_modules
>  1.8G    node_modules
>
>  Some of the largest dependencies:
>
>  $ du -d 1 -am node_modules | sort -n -r | head -n 20
>  1760    node_modules
>  291     node_modules/@storybook
>  85      node_modules/@babel
>  73      node_modules/monaco-editor
>  66      node_modules/@types
>  58      node_modules/@microsoft
>  55      node_modules/typescript
>  43      node_modules/@jest
>  38      node_modules/@svgr
>  29      node_modules/jest
>  28      node_modules/@antv
>  26      node_modules/jest-runtime
>  23      node_modules/react-icons
>  21      node_modules/cypress
>  19      node_modules/react-dev-utils
>  19      node_modules/less
>  19      node_modules/@icons
>  19      node_modules/concurrently
>  18      node_modules/rxjs
>  18      node_modules/listr
>
>  $ ls node_modules | wc -l
>  2022
>
>  Compressing the node_modules folder using zstd:
>  default level: 183 MB
>  zstd level 19: 111 MB
>
>  How can/should we bundle that? Is this size acceptable for a SRPM?
>
>  Bundling it would allow us to build the frontend and run the frontend
>  tests as part of the spec, and we can apply patches properly (without
>  (re)generating anything locally). Most of the patches at least, in case
>  some security patch requires an upgrade of a npm dependency, we also
>  need to recreate the vendor tarball.
>  
It's fine for SRPMs, we have had larger for other things. I know of
cases where entire VM disk images were added as sources in SRPMs,
making them ridiculously large.



-- 
真実はいつも一つ！/ Always, there's only one truth!

[Andreas Gerstmayr]

Hi Neal,

On 01.10.20 18:51, Neal Gompa wrote:
>  It's fine for SRPMs, we have had larger for other things. I know
> of
>  cases where entire VM disk images were added as sources in SRPMs,
>  making them ridiculously large. 
Ah, that's great news. I'll vendor it then and build & test everything 
as part of the specfile. Awesome :)
Thanks!


Cheers,
Andreas

[Jared K. Smith]

On Mon, Oct 5, 2020 at 2:42 PM Andreas Gerstmayr <agerstmayr(a)redhat.com&gt;
wrote:

>  Ah, that's great news. I'll vendor it then and build &
> test everything
>  as part of the specfile. Awesome :)
>  
You are checking the licenses, etc. for all the bundled modules, right?

-Jared

[Andreas Gerstmayr]

Hi Jared,

apologies for the late reply.

Yes, I checked the npm dependencies with a license checker, and verified 
  that they're permissive.


Cheers,
Andreas


On 06.10.20 20:58, Jared K. Smith wrote:
>  On Mon, Oct 5, 2020 at 2:42 PM Andreas Gerstmayr
> <agerstmayr(a)redhat.com 
>  <mailto:[e-mail]>> wrote:
>  
>      Ah, that's great news. I'll vendor it then and build & test everything
>      as part of the specfile. Awesome :)
>  
>  
>  You are checking the licenses, etc. for all the bundled modules, right?
>  
>  -Jared
>  
>  _______________________________________________
>  nodejs mailing list -- nodejs(a)lists.fedoraproject.org
>  To unsubscribe send an email to nodejs-leave(a)lists.fedoraproject.org
>  Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives:
> https://lists.fedoraproject.org/archives/list/[e-mail]
>