What does HackerNews think of node2nix?

Generate Nix expressions to build NPM packages

Language: Nix

You may find something like node2nix helpful (https://github.com/svanderburg/node2nix). This converts your package.json into a Nix expression that can then be cached. You're right that it does require some setup and a bit of Nix knowledge but could yield significant benefits and take a good chunk out of that 20 minutes.

Another option might be to use pnpm instead of Yarn and cache your pnpm dependencies. pnpm actually works a bit like Nix in that it creates a pnpm-lock.yaml file with content-based hashes for the full package.json dependency tree. This enables it to quickly determine which parts of the dependency tree it needs to build and which are already available.

Note: these points concern Nix, the situation may be different on Guix

> * Do packages need to be 'ported' to Nix or its build / install system? If so, how much effort will it take and on what factors the effort required to port may vary substantially? (eg: Programming Language).

Yes. To make Nix really work it has to be pervasive and this sometimes means porting packages again, however there's a lot of automation around this, see[0] for ones that leverage existing build systems in other languages. Autoconf and cmake packages are already accounted for by the default builder, and usually only the dependencies have to be specified.

> * How is disk space usage? Is there any kind of deduplication?

The Nix store can be intensive on memory, as once a dependency such as glibc is updated, all the reverse dependencies (i.e. the set X such that X depends on glibc directly or transitively) have to be rebuilt as well. There is an option to optimise the store, but I don't know how much it helps in practice, see[1]. Garbage collection can be invoked manually or automatically to free up unused store entries.

> * Other performance characteristics - bandwidth (delta upgrades possible?), startup time (I hope this will be good)..

By startup time you might be referring to NixOS. It's very good on my Late 2013 13-inch MacBook Pro, around 20 seconds to go from cold boot to login screen.

[0] https://github.com/svanderburg/node2nix https://github.com/NixOS/cabal2nix https://github.com/cargo2nix/cargo2nix https://github.com/nix-community/poetry2nix https://github.com/kamilchm/go2nix https://github.com/nix-community/pip2nix

[1] https://nixos.wiki/wiki/Storage_optimization

I'm kind of surprised no one has tried to make a standard library for node - although I guess underscore/lodash come close.

The package situation is a serious problem for distro maintainers, which AFAICT have basically given up packaging any npm packages the traditional way. Luckily Nix[1] and Guix[2] can most likely support automatic importing from npm.

Incidentally, one of the many things I love about typescript is that it has zero non-dev dependencies [3].

[1] https://github.com/svanderburg/node2nix [2] https://lists.gnu.org/archive/html/guix-devel/2017-03/msg008... [3] https://www.npmjs.com/package/typescript?activeTab=dependenc...

I'm trying to figure out whether node2nix [0] could help avoid package name/version hijacking vulnerabilities. Node2nix can convert a package-lock.json file to something called a Nix expression [1], like this [2], where each dependency has a checksum. The purpose is to make the Nix expression deterministic so that each Nix package is reproducible.

[0] https://github.com/svanderburg/node2nix

[1] https://nixos.org/nix/about.html

[2] https://github.com/svanderburg/node2nix/blob/22d0c19575ecd19...

Edit: fix link formatting