<div dir="ltr"><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, 22 Oct 2019 at 11:12, Jean-Marie LEMETAYER <<a href="mailto:jean-marie.lemetayer@savoirfairelinux.com">jean-marie.lemetayer@savoirfairelinux.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">The simplest solution is to let npm do its job. Assuming the fetcher<br>
only get the sources of the package, the class will now run<br>
'npm install' to create a build directory. The build directory is then<br>
copied wisely to the destination.<br></blockquote><div><br></div><div>I agree that npm dependency handing is a mess, and we should indeed let npm do the job.<br></div><div><br></div><div>However, 'npm install' pulls various things from the network; this can only be happen during do_fetch(), so that offline builds can continue to work. Whatever has been downloaded, needs to go to DL_DIR.<br></div><div><br></div><div>It also needs to be reproducible (there should be a guarantee that it always pulls the same set of sources which are verified through a checksum of some kind), I guess that can only be achieved through upstream provided shrinkwrap?</div><div><br></div><div>Alex<br></div></div></div>