Re: NPM and trusted binaries

[Pjotr Prins]

On Fri, Sep 09, 2016 at 10:45:43AM +0200, Ludovic Courtès wrote:
 
> Yes, that’s a serious concern.  Maybe all we can reasonably hope to
> achieve is to provide a core subset of the free NPM packages in Guix
> proper, built from source.
> 
> People may still end up using automatically-generated, unchecked
> packages for the rest.  Nevertheless, that would be an improvement over
> the status quo.
> 
> (PyPI, Hackage, CPAN, and CRAN seem to be less problematic in this
> regard, maybe because they are “culturally closer” to the free software
> movement.)

Not quite true, though there are generally less dependencies to deal
with. I still install packages using those language systems -
especially with Ruby, R, D and Elixir. It does not matter. Once I want
robustness I make sure to package in Guix. npm is just the worst of
the lot because of the sheer size, stupidity and circular
dependencies.

We should really think a bit harder about the transitional phase.
Also, software development goes faster in general than that we can
package. 

My take is that GNU Guix proper should be lean, mean and robust. That
way we can maintain and rely on stuff. 

For the more experimental packages and other 'solutions' we ought to
depend on channels - or distributed package sources. These need not
take the purist view.

Pj.