The the Node.js guidelines say about Source0 [1]:
"The canonical method for shipping most node modules is tarballs from
the npm registry"
and
"This method [PP: tarbals from npm] should be preferred to using
checkouts from git or automatically generated tarballs from GitHub."
But I think that in following cases it would be better to use sources
from the upstream project:
1) When the license is not included in NPM but is in upstream project.
o Because we are not supposed to ship the license separate from the
sources.
2) When the tests are not included.
o In this case we need to download the sources from NPM and from
upstream project, which seems redundant and a waste of work.
3) When NPM content is generated and source files are not in NPM.
o This would mean to download sources from NPM and upstream project,
delete the NPM sources in prep and generate the files again.
Are there good reason to enforce the use of NPM sources which I am
missing? What is your opinion?
I would like to suggest to ad those three exceptions to the guidelines.
Piotr
[1]:
https://fedoraproject.org/wiki/Packaging:Node.js?rd=Node.js/Packagers#Using…
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
This message is directed at anyone who maintains a Node.js package in Fedora.
On Friday, FESCo approved the Fedora 29 System-Wide Change to move the default
Node.js interpreter to the 10.x LTS stream. This means that we will need to
ensure that any NPM packages that are present in Rawhide must work on 10.x.
What you need to do if
== ... your current package works fine with both Node.js 8.x and 10.x ==
No action required.
== ... your current package doesn't work with 10.x ==
A) It has an upstream release that does (or you can patch it to work)
- - Prepare the upstream package and build it in Rawhide during the week of June
25th through the 29th. I will update the Node.js interpreter in Rawhide
sometime on Friday, June 22nd so it will be in the buildroot.
B) It cannot be made to work with Node.js 10.x at all
- - If this package is still valuable to have when people are using the 8.x
module stream, contact me directly and we will coordinate including it in the
module.
- - If this package is no longer useful, retire it by June 29th.
-----BEGIN PGP SIGNATURE-----
Version: Mailvelope v2.2.2
Comment: https://www.mailvelope.com
wkYEAREIABAFAlsnm1oJEHolVWI2uqOjAAB7nQCgiuZkpu2fDDHM6F47I8GN
nD81quEAoIJtHaqfWscpZ/ZfjVRobMa3/NM4
=F1U7
-----END PGP SIGNATURE-----
Hello,
I filed this ticket against nodejs-archiver two weeks ago:
https://bugzilla.redhat.com/show_bug.cgi?id=1581012
Unfortunately the maintainer has not yet responded. But according to
pagure, the @nodejs-sig group has commit rights on the package.
Would it be possible for someone in the SIG to take a look? As I
mentioned in the ticket, this is potentially holding up a package
review, so it'd be nice to resolve soon...
Thanks in advance,
Ben Rosser