Basic principles

1. Pulling specific versions of tools to to build dependencies from npm is ok
   npm guarantees immutability, and guarantees to give you the same thing for a given version

2. Code that gets pulled into Node.js deps

• Ideally source code is built/transformed in Node.js build (make node)

• Should be able to build from canonical source

  • Project should have copy of canonical source, GitHub is not immutable, and no guarantee that is is available later
  • Project should be able to float patch on dep if needed
    • Should be able to reproduce same result
      • Need to know and have access to specific versions of tools
    • No dynamic downloads

• Couple of categories that are currently worrying in terms of these principles

  • WASM blobs
  • Minified JavaScript
  • TypeScript

Proposed approach for build steps/transforms that cannot done in make node

• Source for transform/build steps outside of make node is is location/repo under the control of the Node.js project
  • Could be:
    • deps subdirectory
    • fork of repo
    • copy of tarball
    • etc.
  • updater will store copy of canonical source in one of the above, build will be done from versioned copies under control of project.
• All build/transform steps run in Docker container
• Docker container contains all tools, etc., needed other than npm dependencies
  • We store copy of container in location under control of project
  • We store copy of dockerfile used to build container along with container
• Build step run by updater uses known container, known canonical source

Next Steps:

• Figure out how we would store containers
• Figure out how we would store tarballs
• Look at undici and outline how we would implement proposed approach above