Source0 for nodejs modules
by Piotr Popieluch
The the Node.js guidelines say about Source0 [1]:
"The canonical method for shipping most node modules is tarballs from
the npm registry"
and
"This method [PP: tarbals from npm] should be preferred to using
checkouts from git or automatically generated tarballs from GitHub."
But I think that in following cases it would be better to use sources
from the upstream project:
1) When the license is not included in NPM but is in upstream project.
o Because we are not supposed to ship the license separate from the
sources.
2) When the tests are not included.
o In this case we need to download the sources from NPM and from
upstream project, which seems redundant and a waste of work.
3) When NPM content is generated and source files are not in NPM.
o This would mean to download sources from NPM and upstream project,
delete the NPM sources in prep and generate the files again.
Are there good reason to enforce the use of NPM sources which I am
missing? What is your opinion?
I would like to suggest to ad those three exceptions to the guidelines.
Piotr
[1]:
https://fedoraproject.org/wiki/Packaging:Node.js?rd=Node.js/Packagers#Usi...
5 years, 4 months
Future of nodejs-0.10
by Jeff Hickson
Hello all,
First, I hope I'm posting this in the right place. I did a good deal of
looking, and here seemed like the best place.
I've done some significant looking through various sources of information,
including asking on IRC, though I wasn't able to find any real direct
answers to my question.
The best I could find was a link to
https://fedoramagazine.org/node-js-6-x-lts-coming-epel-7/ which stated that
for EL7, nodejs-0.10 was being just changed to 6.x. This doesn't explicitly
say anything about EL6 though, which brings me to the actual question.
Since CVE-2017-11499 covers pretty much every version of NodeJS ( source:
https://nodejs.org/en/blog/vulnerability/july-2017-security-releases/ ) I
was wondering if the fix was going to be backported, or if the NodeJS-0.10
(and 0.12) line was going to be completely dropped, with removal of the
packages from the repo, or something else entirely?
I'm more just hoping to find a more official word on the plans for this. I
can look through Koji and see that it's been untouched since October last
year, and I can look through mailing list posts for the last 12 months, but
I can't really find anything stating the plans for the package.
Cheers,
6 years, 8 months