Hacker News Reader

Comment by MrBuddyCasino | Hacker News Reader

Java‘s Maven never had them, never felt a need for them.

What is their purpose in JS land?

native modules. nodejs can have native modules (written in C++, Rust, etc...). Projects usually ship prebuilt natives binaries (for each arch/OS/Nodejs ABI combination) hosted on GitHub Releases and download them automatically at installation time; fallback to build from source if not found. that's where scripts are used

the reason for not bundling all native binaries is becasue the no. of combinations are huge and it can make module size hundreds of MBs

Having a non-script method of downloading the right native binary would be a good next step.

Yeah this seems manageable.

There should be a path for local building as well. Node.js is being used on a lot of embedded systems. I’d imagine there are also lots of other reasons for local builds.

there's fallback to build from source but it would require the builder to have all the toolchain installed (whatever the library is using: could be gcc, python, rustc....)

Not an NPM user, but you can't specify a set of arch combinations and NPM will get the appropriate prebuilts?

That sounds like an NPM problem that would be relatively easy to fix.

Can the builds be sandboxed with strictly limited capabilities?

All of this sounds solvable, why hasn't it?

This used to be more common but the pattern these days is to have the binaries split into optionalDependencies which declare their supported CPU etc, one per supported platform. Then npm will install just the matching one (optionalDependencies that require a different platform aren't installed).

The fact that most of the ecosystem has moved to this pattern is a big part of why this change is now feasible.

that's why. for those who want to read more about this, napi-rs support this natively

https://napi.rs/docs/deep-dive/release

Maven has plugins which are downloadable modules that run at install time, IIRC?

Off the top of my head the purposes I've seen for them: - building native bindings (node-sass) - asking for funding (core-js)

... Probably a few more but the native case is probably the biggest and the packages I'm using nowadays ship precompiled blobs in optionalDependencies. Install scripts seem to be out of favor.

After the backlash of using postinstall scripts for funding requests, most of that moved to the dedicated infrastructure of the `"funding"` key in package.json [1] and the `npm fund` [2] command. (Not that most companies/users pay any more attention to this funding request messaging other than maybe adding `--no-fund` to some of their `npm install` scripts, but it is still an improvement over using scripts to do it.)

[1] https://docs.npmjs.com/cli/v10/configuring-npm/package-json?...

[2] https://docs.npmjs.com/cli/v11/commands/npm-fund

Reply on news.ycombinator.com