If the npm registry disappeared. How quickly could it be rebuilt? (Without the cooperation of npm inc). Is anyone still mirroring the registry? The migration away from couchdb and the registry software being closed source would make it difficult.
-
Show this thread
-
This is not a thought experiment. This is a real concern and possibility. The community would not be prepared.
3 replies 2 retweets 82 likesShow this thread -
Also, would this even be legal? When you create an npm account you give them the rights to distribute your work. If a new registry spins up, they wouldn’t have those rights. Maybe you would have to filter based on known licenses specified in package.json?
1 reply 0 retweets 31 likesShow this thread -
Replying to @sebmck
You’re allowed to distribute anything open source, so all the ones with explicit licenses you’re fine on. There’s good tooling for telling if a package has a proper license on it. A lawyer could tell you what the fair use case would be for hosting the other public data.
1 reply 0 retweets 2 likes
Last I checked there was a surprising amount of packages without explicit licenses. In fact, we had to add some logic to Yarn to infer the license field from a LICENSE file.
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.
he/him 