If you had to install an npm package by URL, instead of by registry name, would you mind? eg. $ npm install https://website.com/package.tgz $ yarn add https://website.com/package.tgz
-
Show this thread
-
Just to be specific. This is a capability that those npm clients offer TODAY. It circumvents the registry, but that's by design. You can even append a SHA1 hash to the URL to enforce integrity checks, actually safer than the registry because it's author-provided.
3 replies 0 retweets 34 likesShow this thread -
PROS: - Author provided integrity hashes - Distributed package distribution - No guardian of control CONS: - No semver ranges (would only work well for top-level dependencies) - Sketchy availability (increased reliance on multiple servers) - Hard to self-host
5 replies 0 retweets 15 likesShow this thread -
Replying to @sebmck
git based semver matching is another, albeit much slower, preexisting option. adding semver ranges for tarball deps would require some coordination but doesn't seem entirely implausible (some Well Known URL based off the tarball URL).
2 replies 0 retweets 2 likes
Yeah that's another option. Strong git support was actually a requirement for of the Yarn partner teams (who no longer actually uses it...). I did a lot of hacks to make it as fast as possible, including use `git archive` which allows you to request a git remote for a tarball.
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.
he/him 