| 22 Nov 2023 |
 Wanja Hentze | right but that has to run outside of the sandbox | 16:37:15 |
| Wanja Hentze | I'm looking for a pure solution like npmlock2nix (but with support for more insane bullshit) | 16:37:45 |
 Lily Foster | no? fetchers run in the sandbox in general | 16:37:48 |
| Wanja Hentze | yes but pre fetchers don't | 16:38:05 |
| Lily Foster | for the node ones they are the same | 16:38:18 |
| Lily Foster | https://github.com/NixOS/nixpkgs/blob/612493c63d4e8af96b9747b70f86d83b8b73937a/pkgs/build-support/node/fetch-npm-deps/default.nix#L161 | 16:38:53 |
| Wanja Hentze | does that work if you don't pass in hash? | 16:40:39 |
| Lily Foster | In reply to @whentze:matrix.org
does that work if you don't pass in hash? if you mean the arg that sets the outputHash on the derivation, sure it'll work i guess but nix won't be happy when the hash doesn't match after the builder finishes | 16:44:43 |
| Wanja Hentze | right, and npmlock2nix et al. compute that hash instead | 16:46:15 |
| Lily Foster | i'm not sure i follow but also idk what npmlock2nix is, so i'll take your word for it | 16:47:12 |
| Wanja Hentze | it parses package-lock.json in pure nix code and can thus create its own FODs | 16:48:04 |
| Wanja Hentze | no need to maintain a separate hash out of band | 16:48:13 |
| Lily Foster | oh, yeah i was gonna have that too for the nixpkgs stuff soon. someone called it terrible though so i haven't, uh, come back and pushed it yet | 16:49:13 |
| Wanja Hentze | napalm, floco and the new buildNpmModule stuff do it as well | 16:49:32 |
| Wanja Hentze | as does (I believe) dream2niz | 16:49:51 |
| Wanja Hentze | * as does (I believe) dream2nix | 16:49:58 |
| Lily Foster | it was part of a bigger restructure of lockfile parsing and fixup, which will also allow dealing with busted lockfiles in nixpkgs without just having to generate your own and vendor it | 16:50:04 |
| Wanja Hentze | I see, nice ☺️ | 16:50:36 |
| Wanja Hentze | if you could use any help with that let me know | 16:50:54 |
| Lily Foster | i mean if you know rust and want to help, i wish i had someone to collab with, because it's hard when it's just me and most people like shitting on node stuff anyway and calling reproducibility "terrible" | 16:51:31 |
| Wanja Hentze | I do know Rust and I halfway know the lockfile format from working on npmlock2nix | 16:52:51 |
| Wanja Hentze | that was all v1 though | 16:53:00 |
| Lily Foster | yeah we support all v1-3 lockfiles rn (which v1 is shit though and often has incomplete dep graphs store in their lockfiles....) | 16:53:38 |
| Wanja Hentze | yes, v1 is shit | 16:53:59 |
| Wanja Hentze | npmlock2nix only barely supports v2 and does not support v3 at all | 16:54:25 |
| Lily Foster | idk i'd rather work on pnpm stuff at this point, but that's because the more i look into it, the more actually sane it looks (yaml lockfiles aside) | 16:54:45 |
| Wanja Hentze | I think it's dead or dying now because of this | 16:54:45 |
| Wanja Hentze | well, my usecase is packaging already existing stuff. and that stuff usually has package.json and package-lock.json | 16:55:24 |
| Wanja Hentze | if yarn or pnpm can work with those, then sure why not | 16:55:57 |
 hexa | what prevents projects from moving from a yarn v1 to a v2 lockfile? | 19:51:18 |
