Re: npm thoughts

[Alexander Kanavin <alexander.kanavin@linux.intel.com>]

On 03/03/2017 12:45 PM, Josef Holzmayr wrote:
> - Given the current situation, the best practise seems to be to have
> package.json take care of the needed modules, and have it handle that.
> Means in my opinion that there should be as little npm-based stuff
> installed as possible. Exactly one, in the optimal case. Downside: this
> means a second dependency tracking is layered under bitbake. No good
> that sounds....

I've been looking into this for the past few days. Unfortunately, it 
looks like we do need a generic, extensible mechanism for dealing with 
the likes of npm, cargo (i.e. rust), and 'go get' and similar things.

I've just set up a minimal MEAN project on my machine, and npm pulled in 
1087 dependencies just so it could run. This is not 'wrong', it's simply 
where the world of software development is heading. It's just so much 
nicer to get a project started and running this way, than the old way of 
writing Makefiles and installing development dependencies by hand into 
the system. But it does create a headache for distributions, and those 
who need reproducible builds.

I'll write down my ideas (and maybe even a design proposal!) in a few 
days about this.

Alex