Bug#843021: RFP: yarn -- a fast, reliable, and secure package manager for Node.js

2016-11-03 13:32 GMT+01:00 Paolo Greppi <paolo.greppi@libpf.com>:

On 03/11/2016 09:10, Lars Wirzenius wrote:
> On Thu, Nov 03, 2016 at 08:36:21AM +0100, Paolo Greppi wrote:
>> Package name: yarn
>> URL: https://github.com/yarnpkg/yarn
>
> My cmdtest package provides yarn, since the main tool it now provides
> is yarn (a testing tool), not cmdtest. Perhaps your package could be
> called yarnpkg?

cmdtest provides yarn since this commit:
http://git.liw.fi/cgi-bin/cgit/cgit.cgi/cmdtest/commit/?id=859bb5ba9631df883dd7b074ff649ea2ca76e1ad

A package search for yarn currently returns no match.
https://packages.debian.org/search?keywords=yarn

The real issue here is that both cmdtest and the proposed package
install a yarn binary.

The conflict could be addressed in several ways:

1. as you suggest, renaming this package and the binary it installs to
yarnpkg

2. keeping the package name yarn but renaming the binary to yarnpkg

If a rename happens, "yarnjs" should be something more natural for debian users,

considering some other binaries are already renamed with that quite natural "js" suffix.

3. renaming the executable yarn in cmdtest to yarn-something-else, and
have cmdtest provide yarn-something-else

That makes the most sense here, considering what you said about the

popularity and the fact cmdtest has been providing "yarn" binary for such a short time.

Maybe Lars can understand the amount of users it will affect should

be a parameter to decide which package has to rename its binary.

4. ignoring the conflict and setting the Conflict flags in both packages
(https://www.debian.org/doc/debian-policy/ch-relationships.html#s-conflicts)

Conflicts is not meant to be used for that purpose, as the link you give explains it

in details.

This looks similar to what happened with nodejs / node.
To avoid a package naming conflict with the old package node
(https://packages.qa.debian.org/n/node.html), node entered Debian as nodejs.
To avoid a binary conflict, also the binary was renamed nodejs from node.
People who do not use the old node package and like to invoke node as
node rather than nodejs can install the node-legacy package.

Similar to node/nodejs, for 1 and 2 there could be a
yarn-legacy/yarnpkg-legacy package for those who do not use cmdtest and
like to invoke yarn as yarn rather than yarnpkg.
For 3, there could be a cmdtest-legacy package for those who do not use
yarn/yarnpkg and like to invoke the yarn binary in cmdtest as yarn
rather than yarn-something-else.

While technically flawless, in retrospect the way the nodejs conflict
was solved is not a success story in terms of expanding the Debian user
base (which is the main reason for having these trendy packages in).

At the moment we are confusing the newbies who come to Debian for
_javascript_ development.
It would be easier if they could apt-get install node/yarn and then just
type node/yarn to use them.
For comparison, on macOS they can do brew install node/yarn and then
type node/yarn.

For node this may be possible sometime in the future as the old node
package is transitioning to ax25-node and the binary has also been
renamed /usr/sbin/ax25-node.

The TC resolution was to forbid the binary name "node" completely,

because it is too generic - hence the conflict is bound to happen again and again.

Also note the nodejs-legacy package is confusing users a lot, it's not a good

solution to jump into.

Jérémy