Repository navigation
Question: nvm availability through standard package managers #3770
Description
Activity
Installing through npm wouldn't make much sense, since if you need nvm, you don't have node or npm in the first place.
Distributing on apt would be more work for me, and since the only software one should install from a source is software its maintainers put there, most of your stuff shouldn't be coming from apt anyways.
As for why it's per-user - if it's systemwide, then you can't
npm install -gor install/'remove node versions without sudo, and, any global changes one user makes pollute the environment for another user - it's simply a subpar system architecture to share these things across users. You could certainly share the same copy ofnvm.shacross users, and set a different NVM_DIR per user, but the usage of each instance of nvm should be per-user.There are (valid) concerns about installing things via curl/wget
No, there aren't. That's just security theater.
First off, like I said, it would be nice to see this in the wiki, regardless. Even just "I'm choosing not to support package managers such as apt because I don't want to" would have saved me time trying to find out if it was available through a PPA or elsewhere.
Installing through npm wouldn't make much sense, since if you need nvm, you don't have node or npm in the first place.
That's not true at all. Just posting to Python docs to make my point for me: https://virtualenv.pypa.io/en/latest/installation.html . Point is, I don't know why the architecture of this tool is determining how I architect my machine.
Distributing on apt would be more work for me,
Fair. Are you searching for collaborators?
Adding packages on the major platforms, say apt, yum, whatever is popular on Mac OS X these days (homebrew?), WSL/WSL2 (mostly covered by apt, I believe) is not that much extra work. Windows package management is still emergent but as I understand it, it wouldn't make sense anyway as NVM for Windows is a different beast (humorously, also available through winget and chocolatey -- makes it easier to install and update this originally bash native tool on Windows than Linux?).
If I volunteer to get this working through apt, am I going to get support on your side? That is to say, if I volunteer and I reach out to you "feature x isn't working," am I just going to hear "I don't want to support that anyway"?
and since the only software one should install from a source is software its maintainers put there,
?? So I shouldn't install Node via apt, even though it's available? What about a browser, like Firefox? That shouldn't be available through apt? I don't understand what you're saying here.
most of your stuff shouldn't be coming from apt anyways.
Preferably, everything I install is coming from a verified, secure source and has passed at least automated testing to ensure compatibility. Not a random location on the internet from which it's fundamentally impossible to keep everything securely and regularly updated.
you can't npm install -g
If I start from e.g. /bin/npm and make a new project that copies /bin/npm to $HOME/my-project/.nvm/bin/npm, why exactly can't I use
$HOME/my-project/.nvm/bin/npm -g?any global changes one user makes pollute the environment for another user - it's simply a subpar system architecture to share these things across users
Having it available globally doesn't restrict it to only non-user space. Not having it available in a system package does restrict my usage however, in particular, security updates.
No, there aren't. That's just security theater.
Defense in depth is NOT security theater. Curl/Wget don't do basic hash or key checking to make sure what is hosted at the end point hasn't been MITM hijacked. Regardless, this tool should not be determining my security requirements.
You should only install any software through official distribution channels, yes. Meaning, it's up to the maintainers of all software you use how you install that software.
a verified, secure source and has passed at least automated testing to ensure compatibility.
many things on the default apt distros are broken; by definition, "not maintainers" are not qualified to verify compatibility of a piece of software.
If I start from e.g. /bin/npm and make a new project that copies /bin/npm to $HOME/my-project/.nvm/bin/npm, why exactly can't I use $HOME/my-project/.nvm/bin/npm -g?
that's not how npm works; that won't work no matter how you install node/npm.
npm root -gis the location that has to be user-modifiable, and should not be shared across users.Defense in depth is NOT security theater. Curl/Wget don't do basic hash or key checking to make sure what is hosted at the end point hasn't been MITM hijacked. Regardless, this tool should not be determining my security requirements.
It's fair that there should probably be a way to use
--pinnedpubkeywith curl. Either way, it's not determining your security requirements - if you don't want users installing with the official install script, you're welcome to download the scripts yourself (you can even git clone to a known SHA) and then run the install script in situ (readme). However, this is automatic if you have git available on the system you're installing nvm onto, meaning, the only part that's not checked in this way is the install script itself.
If you choose to install someone else's software, you are choosing to obey whatever constraints they wish to impose, on your architecture or security requirements or whatever. If you don't like those constraints, you are free to choose different software. nvm is no different from anything else in this regard.
Okay, I'm not going to continue to debate the relative value of package managers over manual installing through bash scripts here.
Can you respond to these:
First off, like I said, it would be nice to see this in the wiki, regardless. Even just "I'm choosing not to support package managers such as apt because I don't want to" would have saved me time trying to find out if it was available through a PPA or elsewhere.
And:
Fair. Are you searching for collaborators?
...
If I volunteer to get this working through apt, am I going to get support on your side? That is to say, if I volunteer and I reach out to you "feature x isn't working," am I just going to hear "I don't want to support that anyway"?
Potentially offering to volunteer to take this piece over. I (and many others) fundamentally disagree with your perspective on the value of package managers, but regardless, if it's available in package managers, that's what I'm looking for. If I'm going to be fighting you every step of the way to do this, then I'm not interested in taking that on.
If you choose to install someone else's software, you are choosing to obey whatever constraints they wish to impose, on your architecture or security requirements or whatever. If you don't like those constraints, you are free to choose different software. nvm is no different from anything else in this regard.
You're using an MIT license. If you don't want to do the work, that's one thing, but it's really not helpful to lecture strangers on how F/LOSS works.
I'm always searching for contributors on all of my open source projects. The "pull request wanted" label is a great place to start.
That said, I'm not interested in making nvm officially available via any mechanism other than the current one.
This is a general question related to why nvm isn't available / intended to be available through standard packages like apt or even npm.