nodejs October 2013

nodejs@lists.fedoraproject.org

3 participants
3 discussions

[fpc] #311: Node.js guidelines update
by fedora-badges 08 Mar '14

08 Mar '14

#311: Node.js guidelines update -----------------------------+------------------ Reporter: patches | Owner: Type: enhancement | Status: new Priority: minor | Milestone: Component: Guideline Draft | Version: Keywords: | Blocked By: Blocking: | -----------------------------+------------------ We have a couple of changes we'd like to make to the Node.js Guidelines after several months of refining our processes a little bit. You can see the new draft at: https://fedoraproject.org/wiki/User:Patches/PackagingDrafts/NodeJS The changes include: * I've restored the %nodejs_fixdep section included in the original version of the draft. After reviewing the IRC logs, it seemed FPC didn't strongly object to this, and I believe it has several advantages to patch- based workflows. Not only is it simpler for packagers, but it also makes them dead simple to audit later on for staleness/compliance/whathaveyou. (`grep -r nodejs_fixdep` is just a lot easier than trying to find relevant patches. ;-) It also makes changes to dependencies much easier to see in git. [https://fedoraproject.org/wiki/User:Patches/PackagingDrafts/NodeJS#Correcti… (relevant section)] [https://fedoraproject.org/w/index.php?title=User:Patches/PackagingDrafts/No… (diff)] * The RPM magic was recently split into it's own "nodejs-packaging" SRPM, similar to Java. Accordingly, packages can now require "nodejs-packaging" instead of "nodejs-devel" to reduce the number of deps dragged in at build-time. [https://fedoraproject.org/wiki/User:Patches/PackagingDrafts/NodeJS#BuildReq… (relevant section)] [https://fedoraproject.org/w/index.php?title=User:Patches/PackagingDrafts/No… (diff #1)] [https://fedoraproject.org/w/index.php?title=User:Patches/PackagingDrafts/No… (diff #2)] [https://lists.fedoraproject.org/pipermail/nodejs/2013-April/000001.html (list discussion)] * The necessary ExclusiveArch line needed for Node.js packages is now documented, including the %{nodejs_arches} macro recently added to redhat- rpm-config for this purpose. [https://fedoraproject.org/wiki/User:Patches/PackagingDrafts/NodeJS#Exclusiv… (new section)] [https://lists.fedoraproject.org/pipermail/nodejs/2013-May/000017.html (list discussion)] * A strategy for handling multiple/compatibility versions of packages that is transparent to dependent packagers has been implemented. [https://fedoraproject.org/wiki/User:Patches/PackagingDrafts/NodeJS#Handling… (new section)] [https://lists.fedoraproject.org/pipermail/nodejs/2013-June/000032.html (list discussion)] * The %{nodejs_default_filter} default automatic virtual provides filtering macro (similar to Perl's) is now documented. [https://fedoraproject.org/wiki/User:Patches/PackagingDrafts/NodeJS#Filterin… (new section)] * A --check argument was added to %nodejs_symlink_deps simplify running test suites in specs. [https://fedoraproject.org/wiki/User:Patches/PackagingDrafts/NodeJS#.25check (new section)] * A brief mention that additional virtual provides are added for native modules to track ABI compatibility was added. [https://fedoraproject.org/w/index.php?title=User:Patches/PackagingDrafts/No… (diff)] * Some minor edits were made to the installing native modules section to reflect reality; my initial draft contained errors. [https://fedoraproject.org/w/index.php?title=User:Patches/PackagingDrafts/No… (diff)] * A brief note about an additional macro required to enable dependency generation on EPEL was added. [https://fedoraproject.org/w/index.php?title=User:Patches/PackagingDrafts/No… (diff)] I'd like to thank the fledgling Node.js SIG, including Stephen Gallager, Jamie Nguyen, Tom Hughes, and Stanislav Ochotnicky for their valuable bug catching, feedback, and suggestions, without which none of this would be possible. And, also the FPC in advance for reviewing our changes, of course. ;-) -- Ticket URL: <https://fedorahosted.org/fpc/ticket/311> fpc <https://fedoraproject.org/wiki/Packaging:Committee> Fedora Packages Collection Task Tracking

3 6

[HEADSUP] npm in EPEL broken due to rel-eng issue
by T.C. Hollingsworth 03 Jan '14

03 Jan '14

npm currently has broken dependencies in EPEL 6 because of what appears to be a rel-eng issue: https://fedorahosted.org/rel-eng/ticket/5657 Ordinarily I'd unpush that update but I'd rather wait for rel-eng's advice since something strange seems to have gone wrong here. -T.C.

3 7

Call for karma: nodejs-0.10.21 security update
by T.C. Hollingsworth 21 Oct '13

21 Oct '13

Hi, all! So, last night I pushed an update for an undisclosed security update and promptly went to the bar afterward, and in the intervening time the whole Internet has gone crazy! Now it's fairly widely reported that this is a pretty nasty DoS vulnerability, so I'd appreciate some karma on the following updates so we can get this pushed stable ASAP. They've all been pushed to testing as of now. F20: https://admin.fedoraproject.org/updates/FEDORA-2013-19512/ F19: https://admin.fedoraproject.org/updates/FEDORA-2013-19497/ F18: https://admin.fedoraproject.org/updates/FEDORA-2013-19491/ EL6: https://admin.fedoraproject.org/updates/FEDORA-EPEL-2013-11891/ Upstream has somewhat deservedly been put through the ringer for handling this improperly, but in their defense the initial report was just made publicly on github instead of by mail to security(a)nodejs.org so they were pretty much screwed from the get go. I did at least receive a nice apology in my inbox today from one of the lead developers for the lack of early notice to distributions. Thanks in advance! -T.C.

3 3

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

nodejs October 2013