Re: [OE-core] Improve npm support to run build scripts

[Stefan Herbrechtsmeier <stefan.herbrechtsmeier-oss@weidmueller.com>]

Hi Alex,

Am 05.10.2021 um 15:10 schrieb Alexander Kanavin:
> I think the supposed workflow with the new npm.class was to use 'devtool 
> create' which would run some npm magic to to create a single recipe that 
> has all of the npm-fetched dependencies inside SRC_URI.

There is no magic inside npm. It parse json recipes, calculate a 
dependency tree, download archives, checks the archives, unpack the 
archives and run some commands from the json recipes.

The 'devtool add' create a recipe with over 1000 dependencies. A lot of 
the dependencies have an unknown license. I have improve createtool to 
detect more licenses and fallback to the readme if no license file exist.

The npm class doesn't support run of build scripts. The build of an 
application (ex. angular) need native binaries inside its npm dependencies.

The existing solution have the same problems like embedded dependencies 
in other recipes (ex. multiple version of the same project, unneeded 
dependencies, unforeseeable downloads, pre-builds, on the fly binary 
builds, ...)

You have to fix a bug in different versions of the same project at 
different positions in the dependency tree inside multiple recipes.

The main different between a normal (ex C++) and npm project is that npm 
use many small packages as dependency.

> Have you tried that?

Sure. Otherwise I haven't spot the limitations and work on improvements.

> A layer with thousands of recipes seems totally intractable.

What is your concern? The high number of dependencies or to handle it 
via OE?

We have the high number of dependencies in any case and need to handle 
the proxy/CVE/license problem. Could we reuse OE or should we use 
different software for the same problems?

Regards
   Stefan