SUSE Hack Week: package Atom and its dependencies for openSUSE

# A First Level Header
## A Second Level Header

Use one asterisk to *emphasize*

Use two asterisks for **strong emphasis**

- Use hyphens
- for unordereed
- lists

This is an [link to example.com](http://example.com/)

This is an image ![an openSUSE geeko icon](https://en.opensuse.org/images/d/d0/Icon-distribution.png)

This is a user link @hans

This is a project link hw#some-cool-title

More Complex Markdown Help

Formatting Help

# A First Level Header
## A Second Level Header

Use one asterisk to *emphasize*

Use two asterisks for **strong emphasis**

- Use hyphens
- for unordereed
- lists

This is an [link to example.com](http://example.com/)

This is an image ![an openSUSE geeko icon](https://en.opensuse.org/images/d/d0/Icon-distribution.png)

This is a user link @hans

This is a project link hw#some-cool-title

More Complex Markdown Help

Formatting Help

Edit
Preview

Hi, I have been preparing/working on this for about two years. Two main things:

A. We can't use the "one package per nodejs module" packaging method. (Some SUSE people invented or borrowed it to openSUSE in the beginning)

Nodejs modules can have their own 'home' to place dependencies. That is, you can rely on a very very old version of something.
You don't have to update it at all. Because you have your own home. You don't have to update it.

This situation will result two different kinds of troubles:

A.1 security issues. No need to further explain.

A.2 muti-versions co-existed for the same module as different packages.

I maintained devel:languages:nodejs for two+ years. this is heart-breaking. and fragmentation.
Can you imagine to update 200+ packages in one night by hand? 4 times a month? Just no go.

There's even no way to automate it.

package.json can only list the dependencies of this module. no dependencies for a dependency.

You can't shrinkwrap it.  because a batch update will break other packages depend on one of the packages you update (multi-version issue). It is an endless loop as the packages in the repository are growing in amount.

So you can only package one by one. Watch on build.opensuse.org to find out dependencies for one package (no way on your own machine, because you can't see dependency for dependency since you have only one source tarball), package dependencies, find dependencies for dependencies, package, and so on.

Based on these facts. I decided to package nodejs module and all its dependencies in one package (bundle).

That'll be too much easy to maintain and automate.

I invented a "nodejs-packaging" toolkit in github.com/marguerite/nodejs-packaging, which is far more reasonable than the Fedora one. On your own machine, you can use my tool to create a .json file contains a dependency map. And download all the source tarballs needed, Autofill the specfile. Write changelog. Then submit.

For security issues, I invented another tool to parse the .json my tool created and find the specific version of a dependency out among packages in the repository. Easy target, Easy fix.

I have done this last year. But I found my tool is too bad in coding style...and less comments...so I can't even read some parts of it now.

This year, I started it over again, by following Ruby coding style and writing nice comments. Also I wanted to split it into a few standard rubygems so we can maintain it in our ruby repository automatically.

So I'd say your project now highly relies on my process of developing the tool...

B. Atom relies on electron. Currently there's no native build of electron on any distribution.

I started to package electron to make it build natively on OBS last year.

I have finished "libchromiumcontent" package which is basically a rebuild of chromium :-(

But I didn't finish the "electron" yet. Because its build script focus on building on your own machine instead of standard build virtual machine (it uses 'git' at build time), so I have to patch it, and separately package all its dependencies. BTW It is written in Python. Any help is welcome.

Marguerite

Hi, I have been preparing/working on this for about two years. Two main things:

A. We can't use the "one package per nodejs module" packaging method. (Some SUSE people invented or borrowed it to openSUSE in the beginning)

Nodejs modules can have their own 'home' to place dependencies. That is, you can rely on a very very old version of something. You don't have to update it at all. Because you have your own home. You don't have to update it.

This situation will result two different kinds of troubles:

A.1 security issues. No need to further explain.

A.2 muti-versions co-existed for the same module as different packages.

I maintained devel:languages:nodejs for two+ years. this is heart-breaking. and fragmentation. Can you imagine to update 200+ packages in one night by hand? 4 times a month? Just no go.

There's even no way to automate it.

package.json can only list the dependencies of this module. no dependencies for a dependency.

You can't shrinkwrap it. because a batch update will break other packages depend on one of the packages you update (multi-version issue). It is an endless loop as the packages in the repository are growing in amount.