From debbugs-submit-bounces@debbugs.gnu.org Sun Apr 26 13:42:58 2020 Received: (at 40860) by debbugs.gnu.org; 26 Apr 2020 17:42:58 +0000 Received: from localhost ([127.0.0.1]:34836 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1jSlIw-0000Ux-4e for submit@debbugs.gnu.org; Sun, 26 Apr 2020 13:42:58 -0400 Received: from mira.cbaines.net ([212.71.252.8]:44276) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1jSlIv-0000Up-6B for 40860@debbugs.gnu.org; Sun, 26 Apr 2020 13:42:57 -0400 Received: from localhost (unknown [46.237.175.119]) by mira.cbaines.net (Postfix) with ESMTPSA id 026EA27BBE1; Sun, 26 Apr 2020 18:42:55 +0100 (BST) Received: from localhost (localhost [local]) by localhost (OpenSMTPD) with ESMTPA id 63539dc4; Sun, 26 Apr 2020 17:42:53 +0000 (UTC) References: <1ba1944d95080f01f02a11c2484e7cb9fa75f538.camel@runbox.com> User-agent: mu4e 1.2.0; emacs 26.3 From: Christopher Baines To: Kozo Subject: Re: [bug#40860] [PATCH] yarnpkg In-reply-to: <1ba1944d95080f01f02a11c2484e7cb9fa75f538.camel@runbox.com> Date: Sun, 26 Apr 2020 18:42:51 +0100 Message-ID: <878siinnxg.fsf@cbaines.net> MIME-Version: 1.0 Content-Type: multipart/signed; boundary="=-=-="; micalg=pgp-sha512; protocol="application/pgp-signature" X-Spam-Score: 0.0 (/) X-Debbugs-Envelope-To: 40860 Cc: 40860@debbugs.gnu.org X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -1.0 (-) --=-=-= Content-Type: text/plain Kozo writes: > This is my first submission. Please let me know how I can improve for > future packages. > > I followed the steps in the manual and submitted a Software Heritage > request to pull the source code. Hi Kozo, Yarn would indeed be something that would be nice to have a package for. While I guess that this might work, I think there are issues with the source here and the lack of dependencies that make this unsuitable for Guix. > +(define-public yarn > + (package > + (name "yarn") > + (version yarn-version) > + (source (origin > + (method url-fetch/tarbomb) > + (uri (string-append "https://github.com/yarnpkg/yarn/releases/download/v" > + version "/yarn-v" version ".tar.gz")) > + (sha256 > + (base32 > + "0n7vhwjz3lyjnavcaw08cqa8gfampqsy5mm3f555cbqb26m1clxw")))) The key thing here is source. For many reasons, the packages in Guix represent software being built from some source material. What's being downloaded here might look like source material, but I doubt the ~153,409 line lib/cli.js file is really the preferred form for editing the Yarn source code. > + (build-system trivial-build-system) > + (outputs '("out")) > + (inputs `(("node" ,node))) Another sign that something is up is the mismatch between the inputs here, and the dependencies in the upstream metadata [1]. Assuming the package works, I'm guessing that there's a lot more than the source of Yarn within the "source" of this package. 1: https://github.com/yarnpkg/yarn/blob/master/package.json I'm hopeful that package Yarn will become possible sometime soon, but in my mind the path forward is to get an importer working for npm, package the many dependencies, then attempt to package yarn. Unfortunately I don't think there's a bug that tracks this overall issue well, although I did find a similar bug about yarn [2] 2: https://debbugs.gnu.org/cgi/bugreport.cgi?bug=33431 Does that make sense? Thanks, Chris --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQKTBAEBCgB9FiEEPonu50WOcg2XVOCyXiijOwuE9XcFAl6lyBtfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDNF ODlFRUU3NDU4RTcyMEQ5NzU0RTBCMjVFMjhBMzNCMEI4NEY1NzcACgkQXiijOwuE 9XeGpQ/6A9mixGXc2IobxUkE0RnjK5iQkdA4viJxOjnY8rZjvr6nhTIChOorcP8E UYrEePzYYCi7AzIq0EED6ZQShf0auoajzkZhHdVeLsNnvl7mQ/VfQ1H3/Z/GvNy6 Ma66Dsko07DlqQzX8aCNZ7A+XVfr/yewg9NHRtSP3hRiyCfAtQT1Tt3ceViMLqny 9T1rcBZLZtHUldDOcx5t2NMC2e+jBlLj61NqWv2YfRmjI1H4/CZHPHzUBUp6Qphm 3ZQBjG3CzQPWf4etk8KIKNxAOfwxgLC8EfVYYgSV4+vQmDy5VRp8VGcH2xhw1vCo FYDhyT29SpqBw4rQ5eT+gedyvdxK7EOPJkVvmAHXa7vFT8B1yLyBvEVvErtCohD9 yz3EXg6FSz5kAYezq4k/h155MHvQflPSidizhI4i2k90fp+3Y3hwAoTqz8EZ+D45 O3zw+9ItRafCceR6lBzG1XUD2E5MKUqKPAsJtmg68931DYQ1QNgjPBocDBgBhW3g RltUV01kqCjYz1PVVDaoyucNDYoMXvKsYNjA8YBdkAyRcsPmtDepRv/KuVCGZfAb LrddrgkpgUOdTSsCTTo8JqXHN8J/P3ZCvStJu+vEcJS9UK2GH9b1SQqsQHtnFaX8 7ipA7YSZpz+vzWRZckfyKKnsvkLtL9DzMk7HZ3r6Syd9V08uSC4= =QUul -----END PGP SIGNATURE----- --=-=-=--