olm missing from package-lock.json

[Ralith]

Has the lockfile not been updated in a while? This makes it very difficult to produce a NixOS package of riot.

[MTRNord]

I dont think optionalDependencies get locked. The olm dep is optional in the package.json:

"optionalDependencies": {
    "olm": "https://matrix.org/packages/npm/olm/olm-2.2.1.tgz"
},

[Ralith]

All the documentation I can find says they do. It also seems like package-lock.json has been obsoleted by npm-shrinkwrap.json, which suggests that the file has not been updated for a long time indeed. When I create a npm-shrinkwrap.json myself, it contains the "optional" dep and works fine.

[eqyiel]

@Ralith it's the other way around, package-lock.json is the current meta, the design of package-lock.json was informed by npm-shrinkwrap.json:

https://docs.npmjs.com/files/package-lock.json
https://docs.npmjs.com/files/shrinkwrap.json

Note that package-lock.json is only created by npm 5.x and greater, which you might not have if you're using a Node version prior to 8.x: https://github.com/npm/npm/releases/tag/v5.0.0

FWIW, I'm pretty sure I've experienced the same problems that you're describing while updating the riot-electron-nix package. 😿

[lampholder]

FWIW, I'm pretty sure I've experienced the same problems that you're describing while updating the riot-electron-nix package. 😿

Do we need documentation/better documentation?

[eqyiel]

@lampholder I'm not sure, but it would be good to know what the consequences are of packaging riot-web without olm (since it's optional). AFAICT it's a module used for E2E but that's the extent of my knowledge on the matter. 😅

[lampholder]

Hi @eqyiel - olm is indeed used for E2E encryption; tbh I'm not exactly sure what happens when you package Riot without it. I'm 100% certain that encryption won't work, and I'm maybe 80% certain the UX will do the RightThing too (i.e. not let you try and turn on encryption when it's not going to work because your client doesn't support it).

[Ralith]

It looks like this has been fixed, though npm is still making reproducible packaging an utter nightmare.