[Pkg-javascript-devel] Bug#980316: about corepack and yarnpkg

[Paolo Greppi]

I stumbled upon this thread related to packaging corepack for gentoo: 
https://github.com/nodejs/corepack/issues/76

We now have node 16 in experimental, but our package does not bundle 
corepack (as upstream does):
https://packages.debian.org/experimental/amd64/nodejs/filelist

I propose that we create a RFP/ITP for corepack separate from nodejs, 
with Conflicts: yarnpkg

The corepack binary would install /usr/bin/yarnpkg pointing to the 
corepack shims; this would allow Debian users who "use different package 
manager versions across multiple projects" to happily install random 
binaries downloaded from the internet if they wish.

If we agree that we (as a distribution) need specific versions of 
yarnpkg (for building other stuff, we need to keep one or more yarnpkg 
packages in Debian, all with Conflicts: corepack + each other.

If we really want yarnpkg 1, according to my tests, the corepack route 
is useless:

     docker pull node:16
     docker run -it --rm node:16 bash
     yarn -v # 1.22.15
     # this downloads https://registry.npmjs.org/yarn/-/yarn-1.22.17.tgz
     # based on the versions / 1.22.17 / dist / tarball value in:
     # https://registry.yarnpkg.com/yarn/
     corepack prepare yarn at 1.22.17 --activate
     yarn -v # 1.22.15
     corepack yarn -v # 1.22.17
     ls -l /root/.node/corepack

     total 2
     -rw-r--r-- 1 root root 63 Jan  9 18:33 lastKnownGood.json
     drwxr-xr-x 1 root root 14 Jan  9 18:13 yarn

To "build" it quick and dirty we can download once and for all the same 
pre-built binary that corepack would download, extract it and symlink it 
to /usr/bin/yarnpkg (without shims); this package should go to contrib 
since it downloads stuff from the internet during the build, but would 
fix the issue of yarnpkg blocking the migration to webpack5 and removal 
of node-request.
Or else keep alive the current version in main by just bundling into it 
webpack4 and node-request.

If we really want a new yarnpkg3 package, corepack is also useless as it 
merely installs yarnpkg 1.
The upstream recommended way of installing yarnpkg 3 (get yarn 1 with 
corepack then yarn init -2 (sic!)) just downloads the current pre-built 
binary (ATM 
https://repo.yarnpkg.com/3.1.1/packages/yarnpkg-cli/bin/yarn.js, 2199165 
bytes) to .yarn/releases/yarn-3.1.1.cjs.
AFAICT this does not integrate with the shared package manager versions 
stored in ~/.node/corepack.

One way to "build" yarnpkg3 quick and dirty is to download once and for 
all the same pre-built binary that yarn init -2 would download, and 
symlink it to /usr/bin/yarnpkg (without shims).
Or if we want it in main we should replicate the way upstream builds 
this yarn.js binary.

Sorry for the long message, this is a mess!

Paolo