Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Replace npm-installer usage with purs-installer #4528

Open
JordanMartinez opened this issue Jan 18, 2024 · 1 comment
Open

Replace npm-installer usage with purs-installer #4528

JordanMartinez opened this issue Jan 18, 2024 · 1 comment

Comments

@JordanMartinez
Copy link
Contributor

Summary

Replace npm-installer with purs-installer

Motivation

npm i purescript installs PureScript by running npm-installer's install command via a post-install script. The npm-installer codebase is undesirable for a number of reasons:

  1. it's written in JavaScript and thus doesn't utilize type safety. Moreover, it's hard to read in general.
  2. it uses old NPM dependencies which produces a number of warnings and other output.
  3. Per its issues, the codebase cannot install PureScript from source: Building from source doesn't seem to work npm-installer#41
  4. At one time, when this package was originally outside of the core team's control, malicious code was added to it before Harry dealt with that.
  5. While working on the port, I noticed that the binaries downloaded from GitHub are not checked for their integrity via the SHA files.

By rewriting this in PureScript, we gain:

  1. type-safety
  2. readability
  3. updated NPM dependencies
  4. integrity checks
  5. a clean slate

Proposal

I propose a few people from the core team review the work I've done, make edits as needed, and then update our npm-package/package.json to use purs-installer as the post-install script.

Examples

At least one or two examples of the proposal being used.

@JordanMartinez
Copy link
Contributor Author

I think there's two potential issues with my current proposal:

  • purs-installer has no CI checks to verify that ARM builds work, mainly due to GH Actions not having such CI runners available (though they're supposed to enter beta in Jan 2024)
  • purs-installer does not expose a command for building from source, nor have CI checks that verify such installs work. I didn't add that mainly because this feature doesn't appear to work on npm-installer anyway.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant