# Downsides of distributing binaries via npm

**URL:** <https://discourse.haskell.org/t/downsides-of-distributing-binaries-via-npm/1005>\
**Category:** Show and Tell\
**Created:** [December 8, 2019, 4:08pm UTC](https://discourse.haskell.org/t/downsides-of-distributing-binaries-via-npm/1005 "2019-12-08T16:08:55Z")\
**Posts on this page:** 12\
**Page:** 1

<div class="post-metadata">

**Author:** ![k-bx](https://sea2.discourse-cdn.com/flex002/user_avatar/discourse.haskell.org/k-bx/32/167_2.png) [@k-bx](https://discourse.haskell.org/u/k-bx)\
**Post date:** [December 8, 2019, 4:08pm UTC](https://discourse.haskell.org/t/downsides-of-distributing-binaries-via-npm/1005/1 "2019-12-08T16:08:55Z")

</div>

I’ve decided to use `npm` as means of distributing binaries for my [github-agent](https://github.com/k-bx/github-agent) little software. What do you think about this choice, how bad is it? Seems like not a bad option for little tools written in Haskell where you don’t want to spend too much time wrestling with snap/flatpak/deb/brew stuff.

I stole the scripts from the Elm project.

---

<div class="post-metadata">

**Author:** ![belka](https://avatars.discourse-cdn.com/v4/letter/b/e274bd/32.png) [@belka](https://discourse.haskell.org/u/belka)\
**Post date:** [December 8, 2019, 4:25pm UTC](https://discourse.haskell.org/t/downsides-of-distributing-binaries-via-npm/1005/2 "2019-12-08T16:25:07Z")

</div>

A bit strange for non-js project, github release binaries would be for me enough.

Regarding binaries, Facebook does this all the time (thesee are mostly OCaml-Binaries, but js-related), with bucklescript/reason and flow.js. And they use Packagist (PHP registry) for Hacklang projects (but are working on their own package manager)…

---

<div class="post-metadata">

**Author:** ![k-bx](https://sea2.discourse-cdn.com/flex002/user_avatar/discourse.haskell.org/k-bx/32/167_2.png) [@k-bx](https://discourse.haskell.org/u/k-bx)\
**Post date:** [December 9, 2019, 11:06am UTC](https://discourse.haskell.org/t/downsides-of-distributing-binaries-via-npm/1005/4 "2019-12-09T11:06:30Z")

</div>

You mean the version, assets or something else? For version, 0.1.0.0 doesn’t work with npm. For assets, I agree, I’ve used one Elm has but would prefer something mentioning the program.

---

<div class="post-metadata">

**Author:** ![belka](https://avatars.discourse-cdn.com/v4/letter/b/e274bd/32.png) [@belka](https://discourse.haskell.org/u/belka)\
**Post date:** [December 9, 2019, 12:05pm UTC](https://discourse.haskell.org/t/downsides-of-distributing-binaries-via-npm/1005/5 "2019-12-09T12:05:40Z")

</div>

Names like `pandoc-2.8.1-linux-amd64.tar.gz` or `github-agent-1.1.0-linux-x86_64.gz` are more common than `binary-for-linux-64-bit.gz`.

---

<div class="post-metadata">

**Author:** ![k-bx](https://sea2.discourse-cdn.com/flex002/user_avatar/discourse.haskell.org/k-bx/32/167_2.png) [@k-bx](https://discourse.haskell.org/u/k-bx)\
**Post date:** [December 9, 2019, 12:37pm UTC](https://discourse.haskell.org/t/downsides-of-distributing-binaries-via-npm/1005/6 "2019-12-09T12:37:31Z")

</div>

I see. Agreed, will plan for the change in future.

---

<div class="post-metadata">

**Author:** ![ChShersh](https://sea2.discourse-cdn.com/flex002/user_avatar/discourse.haskell.org/chshersh/32/2551_2.png) [@ChShersh](https://discourse.haskell.org/u/ChShersh)\
**Post date:** [February 25, 2020, 11:30am UTC](https://discourse.haskell.org/t/downsides-of-distributing-binaries-via-npm/1005/8 "2020-02-25T11:30:43Z")

</div>

@belka While we’re on this subject, is there a tool that allows easy packaging of Haskell projects into archives of a such format for various platforms including Linux, macOS and Windows? Or at least some blog post or guide about what these archives should contain except the binary itself. I noticed that such GItHub releases are common, for example, in Rust world. But I’d love to know best-practices regarding GitHub releases 🙂

---

<div class="post-metadata">

**Author:** ![vmchale](https://sea2.discourse-cdn.com/flex002/user_avatar/discourse.haskell.org/vmchale/32/86_2.png) [@vmchale](https://discourse.haskell.org/u/vmchale)\
**Post date:** [February 25, 2020, 6:26pm UTC](https://discourse.haskell.org/t/downsides-of-distributing-binaries-via-npm/1005/9 "2020-02-25T18:26:15Z")

</div>

I mean, I wouldn’t use `npm` because it’s not terribly secure.

Sometimes in the past I’ve supplied bash scripts to users, though that has problems.

---

<div class="post-metadata">

**Author:** ![vmchale](https://sea2.discourse-cdn.com/flex002/user_avatar/discourse.haskell.org/vmchale/32/86_2.png) [@vmchale](https://discourse.haskell.org/u/vmchale)\
**Post date:** [February 25, 2020, 6:31pm UTC](https://discourse.haskell.org/t/downsides-of-distributing-binaries-via-npm/1005/10 "2020-02-25T18:31:07Z")

</div>

If you have a binary, I think what’s normally done is distributing various archives with the OS/architecture in the filename.

---

<div class="post-metadata">

**Author:** ![belka](https://avatars.discourse-cdn.com/v4/letter/b/e274bd/32.png) [@belka](https://discourse.haskell.org/u/belka)\
**Post date:** [February 26, 2020, 8:53pm UTC](https://discourse.haskell.org/t/downsides-of-distributing-binaries-via-npm/1005/11 "2020-02-26T20:53:28Z")

</div>

Unfortunately I have no idea, I’ve never used these GitHub archives for my own projects. I suppose people, who deploy them automatically, use GitHub API. You can then package your artifacts as part of your CI/CD pipeline and upload them using GitHub API. I think I saw some libraries for working with the old, REST-based, GitHub API on Hackage, but I’m not sure if there is something for the new, GraphQL-based API.

As for format, I don’t think there are any best-practices; every project is different. A few D projects, I was working on, just build a statically linked binary, compress and upload it. But for some reason they use `.tar.gz` but it shouldn’t be needed, if it is a single binary, just gzip it (without tar).

---

<div class="post-metadata">

**Author:** ![ad-si](https://sea2.discourse-cdn.com/flex002/user_avatar/discourse.haskell.org/ad-si/32/3765_2.png) [@ad-si](https://discourse.haskell.org/u/ad-si)\
**Post date:** [March 1, 2020, 9:35pm UTC](https://discourse.haskell.org/t/downsides-of-distributing-binaries-via-npm/1005/12 "2020-03-01T21:35:04Z")

</div>

I think it’s not a bad idea. I actually wonder why still no one has pushed for an universal package manager which supports all programming languages. I havy many multi language projects and it’s pretty annoying if f you have to maintain several package files and so on. I guess GitHub’s [https://github.com/features/packages](https://github.com/features/packages) is heading in this direction …

---

<div class="post-metadata">

**Author:** ![belka](https://avatars.discourse-cdn.com/v4/letter/b/e274bd/32.png) [@belka](https://discourse.haskell.org/u/belka)\
**Post date:** [March 1, 2020, 10:00pm UTC](https://discourse.haskell.org/t/downsides-of-distributing-binaries-via-npm/1005/13 "2020-03-01T22:00:29Z")

</div>

You mean package registry/repository? Besides GitHub Packages there are projects like jfrog artifactory (commercial). It supports php composer, npm, docker, ruby gems, maven… and custom layouts. Maven is mostly known in Java, I think, but also D’s package manager, dub, supports maven repositories. So there are definitely a few of them.

As for package managers, it’s probably difficult to bring a completely new solution, because each language has its own established infrastructure, that is often mature and well-documented; and it is almost impossible to compete with all of them. Nix allows to build packages from different languages, but it’s kind of difficult, requires know-how and workarounds to work with ruby, js, php packages.

---

<div class="post-metadata">

**Author:** ![avanov](https://sea2.discourse-cdn.com/flex002/user_avatar/discourse.haskell.org/avanov/32/443_2.png) [@avanov](https://discourse.haskell.org/u/avanov)\
**Post date:** [June 7, 2020, 12:37pm UTC](https://discourse.haskell.org/t/downsides-of-distributing-binaries-via-npm/1005/14 "2020-06-07T12:37:10Z")

</div>

How about Nix and [Snack](https://github.com/nmattia/snack)?