Arch Linux User Repository

Should I do it?

i have absolutely no opinion on the matter. personally, i would have probably moved the package to use fnm, too. it's small and fast, plus, it gets cool points for being rewritten in rust.

that said, nvm is more well-known and battle-tested, and likely not as foreign to people who write node regularly, or to people who don't write in node at all -- it's this latter group that has likely never even heard of fnm.

@sudoforge I can use nvm instead of fnm. Should I do it?

@verdrisarko: baseless fearmongering serves nobody. Show me the enlargened attack vector and I'll revert the change.

@phnx47: the wiki page talks about nvm, yes, but not fnm.

@vedrisarko Build issues with different NodeJS versions. LedherHQ build it with NodeJS 16 and put info to .nvmrc: https://github.com/LedgerHQ/ledger-live/blob/develop/.nvmrc.

Here 3 options:

1) Test with every NodeJS after changes. It is what I did before, but it is time consuming.

2) Pin dependency to nodejs-lts-gallium. This will be conflicts dependency with rebuild if you use different NodeJS version in your machine.

3) Use fnm or nvm and read version from .nvmrc: check '4. Using nvm' - https://wiki.archlinux.org/title/Node.js_package_guidelines. fnm is better alternative for nvm. But both of them from AUR.

@vedrisarko Do you have any issue with this? If you worry about 'make' dependencies, you can use ledger-live-bin.

This package worked 100% in 2.49.2-4 before you added package fnm.

Why did you add package fnm?

Adding package fnm just increased the attack vector likelihood of this package and decreased the security potential of this package. fnm is an unnecessary package.

BEWARE

@sudoforge No worries! Thank you for your feedback!

i don't think i've actually updated that package since adopting it; it's wildly out of date and needs to be dramatically improved. thanks for reminding me about that!

i think my brain is fried from a long day; you're absolutely right that dist isn't relevant. anyway, glad you were able to get the invalid symlink / erroneous copy fixed!

@sudoforge You are also use copy instead of move in your packages. What is your point? https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=google-appengine-go#n53

@sudoforge It is no difference for package size. Only pkgdir uses. I never see anyone moves files from srcdir to pkgdir, only copy.

srcdir This points to the directory where makepkg extracts or symlinks all files in the source array.

pkgdir This points to the directory where makepkg bundles the installed package, which becomes the root directory of your built package.

All of the files that you're copying from linux-unpacked. Because you're copying instead of moving, you're duplicating the entire contents of that directory.