Facebook recently published yarn, a package manager that behaves like Bundler and Cargo by having a lock file that describes the exact versions of all transitive dependencies.
I investigated the yarn.lock format, and was pleasantly surprised that it actually contains both direct download links to (and SHA1 hashes of) the .tgz files that make up packages.
I'm very much open to merge this with @svanderburg's node2nix, but I'm not sure that that's appropriate.
Progress
Facebook recently published yarn, a package manager that behaves like Bundler and Cargo by having a lock file that describes the exact versions of all transitive dependencies.
I investigated the
yarn.lockformat, and was pleasantly surprised that it actually contains both direct download links to (and SHA1 hashes of) the.tgzfiles that make up packages.I'm very much open to merge this with @svanderburg's
node2nix, but I'm not sure that that's appropriate.Progress