[Pkg-javascript-devel] Bug#980316: about corepack and yarnpkg

[Pirate Praveen]

On തി, ജനു 24 2022 at 10:01:30 രാവിലെ +0100 
+0100, Paolo Greppi <paolo.greppi at libpf.com> wrote:
> Hi all
> 
> Il 09/01/22 21:59, Paolo Greppi ha scritto:
>> I stumbled upon this thread related to packaging corepack for 
>> gentoo: https://github.com/nodejs/corepack/issues/76
>> 
>> We now have node 16 in experimental, but our package does not bundle 
>> corepack (as upstream does):
>> https://packages.debian.org/experimental/amd64/nodejs/filelist
>> 
>> I propose that we create a RFP/ITP for corepack separate from 
>> nodejs, with Conflicts: yarnpkg
>> 
>> The corepack binary would install /usr/bin/yarnpkg pointing to the 
>> corepack shims; this would allow Debian users who "use different 
>> package manager versions across multiple projects" to happily 
>> install random binaries downloaded from the internet if they wish.
>> 
>> If we agree that we (as a distribution) need specific versions of 
>> yarnpkg (for building other stuff, we need to keep one or more 
>> yarnpkg packages in Debian, all with Conflicts: corepack + each 
>> other.
>> 
>> If we really want yarnpkg 1, according to my tests, the corepack 
>> route is useless:
>> 
>>      docker pull node:16
>>      docker run -it --rm node:16 bash
>>      yarn -v # 1.22.15
>>      # this downloads 
>> https://registry.npmjs.org/yarn/-/yarn-1.22.17.tgz
>>      # based on the versions / 1.22.17 / dist / tarball value in:
>>      # https://registry.yarnpkg.com/yarn/
>>      corepack prepare yarn at 1.22.17 --activate
>>      yarn -v # 1.22.15
>>      corepack yarn -v # 1.22.17
>>      ls -l /root/.node/corepack
>> 
>>      total 2
>>      -rw-r--r-- 1 root root 63 Jan  9 18:33 lastKnownGood.json
>>      drwxr-xr-x 1 root root 14 Jan  9 18:13 yarn
>> 
>> To "build" it quick and dirty we can download once and for all the 
>> same pre-built binary that corepack would download, extract it and 
>> symlink it to /usr/bin/yarnpkg (without shims); this package should 
>> go to contrib since it downloads stuff from the internet during the 
>> build, but would fix the issue of yarnpkg blocking the migration to 
>> webpack5 and removal of node-request.
>> Or else keep alive the current version in main by just bundling into 
>> it webpack4 and node-request.
>> 
>> If we really want a new yarnpkg3 package, corepack is also useless 
>> as it merely installs yarnpkg 1.
>> 

I was able to build yarnpkg berry (it was at 2.x at that time) from 
corepack repo. 
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=980316#5 Are you sure 
it longer works? This was actually suggested by upstream.

>> The upstream recommended way of installing yarnpkg 3 (get yarn 1 
>> with corepack then yarn init -2 (sic!)) just downloads the current 
>> pre-built binary (ATM 
>> https://repo.yarnpkg.com/3.1.1/packages/yarnpkg-cli/bin/yarn.js, 
>> 2199165 bytes) to .yarn/releases/yarn-3.1.1.cjs.
>> AFAICT this does not integrate with the shared package manager 
>> versions stored in ~/.node/corepack.
>> 
>> One way to "build" yarnpkg3 quick and dirty is to download once and 
>> for all the same pre-built binary that yarn init -2 would download, 
>> and symlink it to /usr/bin/yarnpkg (without shims).
>> Or if we want it in main we should replicate the way upstream builds 
>> this yarn.js binary.
>> 
>> Sorry for the long message, this is a mess!
>> 
>> Paolo
>> 
> 
> the bugs related to yarn 1 are piling up, what do we want to do as a 
> team on this ?
> 
> I vote for keeping yarn 1 in the archive by bundling into it 
> node-babel-eslint, webpack4 and 
> node-request-capture-har/node-request. This would address #1002902, 
> #1001630, #1000582 and #958686.
> 
> BTW in the meantime nobody created a RFP/ITP for corepack: it looks 
> like there's not so much interest for that.

We packaged some of its dependencies as part of last outreachy round 
but could not finish it.