Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Should Corepack stay in the Node.js distribution? #1697

Merged
merged 20 commits into from
Mar 19, 2025

Conversation

github-actions[bot]
Copy link
Contributor

@github-actions github-actions bot commented Mar 10, 2025

Background: #1527

Vote instructions:

To close the vote, at least 3 secret holder(s)1 must run the following command: git node vote https://github.com/nodejs/TSC/pull/1697 --decrypt-key-part --post-comment

/cc @nodejs/tsc

Current estimated participation: 94.44%

Footnotes

  1. secret holders are folks who have access to the private key associated with a public key on hkps://keys.openpgp.org that references an email address listed on the TSC voting member list at the time of the opening of the vote.

github-actions bot and others added 3 commits March 10, 2025 09:53

Verified

This commit was created on GitHub.com and signed with GitHub’s verified signature.

Verified

This commit was signed with the committer’s verified signature.
marco-ippolito Marco Ippolito

Verified

This commit was created on GitHub.com and signed with GitHub’s verified signature.
@mcollina
Copy link
Member

Didn't work:

remote: Resolving deltas: 100% (3/3), completed with 3 local objects.
remote: error: GH013: Repository rule violations found for refs/heads/votes/e4f313dc-6121-47bb-830d-d85f80d6ee33.
remote: Review all repository rules at https://github.com/nodejs/TSC/rules?ref=refs%2Fheads%2Fvotes%2Fe4f313dc-6121-47bb-830d-d85f80d6ee33
remote:
remote: - Commits must have verified signatures.
remote:   Found 1 violation:
remote:
remote:   8163b99b3b54ff6b9b2753a9146d5072fe7c45d1
remote:
To github.com:nodejs/TSC.git
 ! [remote rejected] HEAD -> votes/e4f313dc-6121-47bb-830d-d85f80d6ee33 (push declined due to repository rule violations)
error: failed to push some refs to 'github.com:nodejs/TSC.git'
Error: git push,git@github.com:nodejs/TSC.git,HEAD:votes/e4f313dc-6121-47bb-830d-d85f80d6ee33 failed: 1
    at ChildProcess.<anonymous> (file:///Users/matteo/.nvm/versions/node/v22.14.0/lib/node_modules/node-core-utils/node_modules/@node-core/caritat/dist/utils/runChildProcessAsync.js:32:27)
    at ChildProcess.emit (node:events:518:28)
    at maybeClose (node:internal/child_process:1101:16)
    at ChildProcess._handle.onexit (node:internal/child_process:304:5)

how can I handle this?

targos and others added 2 commits March 10, 2025 14:09

Verified

This commit was signed with the committer’s verified signature.
targos Michaël Zasso

Verified

This commit was signed with the committer’s verified signature.
mcollina Matteo Collina
@mcollina
Copy link
Member

mcollina commented Mar 10, 2025

In case you wonder, the correct command is git node vote https://github.com/nodejs/TSC/pull/1697 --gpg-sign I've updated it.

Verified

This commit was created on GitHub.com and signed with GitHub’s verified signature.

Verified

This commit was signed with the committer’s verified signature.
aduh95 Antoine du Hamel
@anonrig anonrig mentioned this pull request Mar 11, 2025
@mcollina
Copy link
Member

@nodejs/tsc please vote.

@anonrig
Copy link
Member

anonrig commented Mar 11, 2025

In case you wonder, the correct command is git node vote https://github.com/nodejs/TSC/pull/1697 --gpg-sign I've updated it.

I couldn't sign it with SSH key. Is GPG the only way?

@aduh95
Copy link
Contributor

aduh95 commented Mar 11, 2025

Is GPG the only way?

No, GitHub supports different kind of signatures, including SSH and PGP.

Verified

This commit was signed with the committer’s verified signature.
RafaelGSS Rafael Gonzaga

This comment was marked as resolved.

richardlau and others added 2 commits March 12, 2025 12:37

Verified

This commit was signed with the committer’s verified signature.
richardlau Richard Lau

Verified

This commit was created on GitHub.com and signed with GitHub’s verified signature.
@RafaelGSS

This comment was marked as resolved.

mhdawson and others added 4 commits March 12, 2025 11:47

Verified

This commit was created on GitHub.com and signed with GitHub’s verified signature.

Verified

This commit was created on GitHub.com and signed with GitHub’s verified signature.

Verified

This commit was signed with the committer’s verified signature.
ruyadorno Ruy Adorno

Verified

This commit was signed with the committer’s verified signature.
RafaelGSS Rafael Gonzaga
@marco-ippolito
Copy link
Member

Its been a week should we close it?

@anonrig

This comment was marked as resolved.

Verified

This commit was signed with the committer’s verified signature.
joyeecheung Joyee Cheung
@joyeecheung
Copy link
Member

FWIW what worked for me (I already have GPG keys installed locally, that is, I can use gpg/dotgpg just alright with the Node.js secrets repo to work with the build machines. but I've not been setting it up to sign commits after I switched to a new macOS laptop & upgraded macOS) is

git config --global gpg.program gpg
git config --global commit.gpgsign true
export GPG_TTY=$(tty)

@mhdawson
Copy link
Member

@anonrig would using the UI instead of using the script be an option for you?

Verified

This commit was signed with the committer’s verified signature.
anonrig Yagiz Nizipli
@mcollina
Copy link
Member

I would like to close this vote, and for this effect, I'm revealing my key part:

-----BEGIN SHAMIR KEY PART-----
GiimmGmsHIegfNJ0q4BzDJ8RgbkRuFV4neVQyeOY0o8K
-----END SHAMIR KEY PART-----

@RafaelGSS
Copy link
Member

I would like to close this vote, and for this effect, I'm revealing my key part:

-----BEGIN SHAMIR KEY PART-----
+mOArcCPXoJKXvJuqC639VcWC4he4zeLtIuP1calMjsM
-----END SHAMIR KEY PART-----

Verified

This commit was created on GitHub.com and signed with GitHub’s verified signature.
Copy link
Contributor Author

Election results

Subject: Should Corepack stay in the Node.js distribution?
End date: 2025-03-19T15:34:53.878Z
Participation: 94.44%

Results

Winning candidate: Phase out later: stop distributing Corepack (i.e. the distribution will no longer contain a corepack executable) on future (i.e. 25+) release lines of Node.js – existing release lines as well as the very next (i.e. 24.x) will keep it as experimental.

Table of results

Candidate Number of won duels
Phase out later: stop distributing Corepack (i.e. the distribution will no longer contain a corepack executable) on future (i.e. 25+) release lines of Node.js – existing release lines as well as the very next (i.e. 24.x) will keep it as experimental. 4
Phase out: stop distributing Corepack (i.e. the distribution will no longer contain a corepack executable) on future release lines of Node.js – existing release lines will keep it as experimental. 3
Stable and Disabled: keep distributing Corepack disabled (i.e. only the corepack executable in the distribution), and mark it stable in a future release line. 2
Status Quo: keep distributing Corepack with Node.js, experimental and disabled (i.e. only the corepack executable in the distribution), exactly as it is today. 1
Stable and Enabled: keep distributing Corepack with Node.js, enabled (i.e. corepack, pnpm, and yarn executables in the distribution), and mark it stable in a future release line. 0

Voting data

Participants:

Private key to decrypt ballots
-----BEGIN PRIVATE KEY-----
MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCuU1vCWncgKCyF
tWbB6MCai4MSB+HGXNibuFU5jGcU7loOE93wd8DT5S0q6Xvk2ystLiOF/PngADx4
CQbSEmeKdM35roU79I2vn/0R57EfQhv9Z5r9bAdbht2lYuq3dwMrIWuVHJ0ZzqVb
kjYwavbCMym7zBvTXAL9Jkyt3k1jdvq2ayU8J1kGJFX44n7/dUd65qYGrbghf/Bd
fdhhz9CPQ0N/xjAmsQXRniu7sm+yiMhG5NivuvVzQymaLlTe1RYJXe3NgbbViYO/
kYXoXFXO5AIfCPA+vmVh1sdBB1YSexcKO7RrOua82C/PRTWd5M/jx7P/1ux4Sy+y
i35kBcR9AgMBAAECggEAIb/hs+7vwToF5J0KF+CH6WO5LHR6MX0oMn2tgka8bkD3
DmKqRTPqERv9cqFhax1DbqvQFNC1T7i7/EFDIMiPYy7Z8czn3oOqKqY+yIiisfqK
kLTOPOH9SqsBnlNYPcy8wEzoFyZDBAwN13ynIRiUTWS6X7FUcccOjRQtJDw1n1vG
4Z+2mmOH46l+PTZoLBjpsgp+4OfeyjQX7yZkkIvPhM0CKvfnU0amE4UzJWDGFTEY
n8WoLiB3yEQcFQjCeP/VYCoi426V8NxE8ENAdBUeuS9z0DBWFVmPy6Z4bMCTgGqF
RRT4qNyhMah3C2bfTY9QNPRqhOw9YUiQLRGZbH/kAQKBgQD0glnIKNKz0pVlVG3I
B6LMcFFBNPLLrB+aLYB01+esOccqkHpDtX7HDirPVvgLdAQJiEuvpQNhh0G/dAMR
OpkrvValatWkf2OCR2KFeOxFfWHRIn1XDNCdYLhplkhkNzHF7UlHyFpjuJ/BKseU
QspFankhHRQOZHxdN2Xiiz3KsQKBgQC2hKQVNGCLOvSXaFEYaRydCi0aVuutJJyp
aSndGoZTIZR90WS8HaAjw4vC1psrToPSGLN4tAaM92Mkjqqg5wMhgANY5gg128DY
N8a3AZCcyAWkPf64ZPE6gIIJWD50lKCwCBRd1Hw7tO75s7SeCceeucdSIeYCSKGY
55SHjBVxjQKBgQCtwOPkZX4143Pe6jyJZUO/XCGh4OqY6dwbSDJ81eEAdp6eFMWN
0DAjbGHnrbnfCbbEv2Jpky3v5JpIXzy+xZGLj6U/L8haeVxRfED68I+WYh9c6tF/
RtAIxm7GOdF/xelM6e6lYC87pjuAndHt/fiXk644Zd2WzLnD1FZGwwRKQQKBgQCt
AH0nPEZmsrM08MQthzSABi1KUimCLLnyOqRb19CK68F8oQYC6XHpdGj9fb4HBp0c
gB1dxAaRh8yJ0lEZwt7M2jJSCXiu1GWujO/md61DbrUqQTk4PzYIZdbcVLCegGLv
eDkV11sKnS4Hsbb6NfrpEN9Fkqwabg3+iUPYV4fb4QKBgH0owPR23f29Bzj5Zmc6
lSRtgZ7jjKBfDsvzW2IAaHw90Dl84Ew/U1JHcBJTD/kQOHhbE5ooA2GIHrJE9LVK
gN5kJjH4LDdsZyFE7eHSj3Yb/za47zKUPUx+claIdrGYLZowMe3XepLWH5Z/6ab4
N8TrgHfzlg9nAuZ/7E++amuv
-----END PRIVATE KEY-----
Discarded commits

Some commits have not been taken into account when counting the ballots:

[
  {
    "commitInfo": {
      "sha": "17fae0a86603c2c9f7b850835fe82e797afec4d6",
      "signatureStatus": "E",
      "author": "RafaelGSS <rafael.nunu@hotmail.com>",
      "files": [
        "votes/e4f313dc-6121-47bb-830d-d85f80d6ee33/RafaelGSS.json"
      ]
    },
    "reason": "The commit author (RafaelGSS <rafael.nunu@hotmail.com>) is not in the list of allowed voters."
  }
]

Footnotes

    1. Stable and Disabled: keep distributing Corepack disabled (i.e. only the corepack executable in the distribution), and mark it stable in a future release line.
    2. Phase out later: stop distributing Corepack (i.e. the distribution will no longer contain a corepack executable) on future (i.e. 25+) release lines of Node.js – existing release lines as well as the very next (i.e. 24.x) will keep it as experimental and Stable and Enabled: keep distributing Corepack with Node.js, enabled (i.e. corepack, pnpm, and yarn executables in the distribution), and mark it stable in a future release line.
    3. Status Quo: keep distributing Corepack with Node.js, experimental and disabled (i.e. only the corepack executable in the distribution), exactly as it is today.
    4. Phase out: stop distributing Corepack (i.e. the distribution will no longer contain a corepack executable) on future release lines of Node.js – existing release lines will keep it as experimental.
  1. Voted against Stable and Enabled: keep distributing Corepack with Node.js, enabled (i.e. corepack, pnpm, and yarn executables in the distribution), and mark it stable in a future release line.

  2. Abstained.

  3. Voted for Phase out later: stop distributing Corepack (i.e. the distribution will no longer contain a corepack executable) on future (i.e. 25+) release lines of Node.js – existing release lines as well as the very next (i.e. 24.x) will keep it as experimental.

    1. Phase out: stop distributing Corepack (i.e. the distribution will no longer contain a corepack executable) on future release lines of Node.js – existing release lines will keep it as experimental.
    2. Stable and Disabled: keep distributing Corepack disabled (i.e. only the corepack executable in the distribution), and mark it stable in a future release line.
    3. Stable and Enabled: keep distributing Corepack with Node.js, enabled (i.e. corepack, pnpm, and yarn executables in the distribution), and mark it stable in a future release line, Status Quo: keep distributing Corepack with Node.js, experimental and disabled (i.e. only the corepack executable in the distribution), exactly as it is today, and Phase out later: stop distributing Corepack (i.e. the distribution will no longer contain a corepack executable) on future (i.e. 25+) release lines of Node.js – existing release lines as well as the very next (i.e. 24.x) will keep it as experimental.
  4. Voted for Phase out: stop distributing Corepack (i.e. the distribution will no longer contain a corepack executable) on future release lines of Node.js – existing release lines will keep it as experimental.

    1. Phase out later: stop distributing Corepack (i.e. the distribution will no longer contain a corepack executable) on future (i.e. 25+) release lines of Node.js – existing release lines as well as the very next (i.e. 24.x) will keep it as experimental.
    2. Phase out: stop distributing Corepack (i.e. the distribution will no longer contain a corepack executable) on future release lines of Node.js – existing release lines will keep it as experimental.
    3. Stable and Disabled: keep distributing Corepack disabled (i.e. only the corepack executable in the distribution), and mark it stable in a future release line.
    4. Status Quo: keep distributing Corepack with Node.js, experimental and disabled (i.e. only the corepack executable in the distribution), exactly as it is today.
    5. Stable and Enabled: keep distributing Corepack with Node.js, enabled (i.e. corepack, pnpm, and yarn executables in the distribution), and mark it stable in a future release line.
    1. Phase out later: stop distributing Corepack (i.e. the distribution will no longer contain a corepack executable) on future (i.e. 25+) release lines of Node.js – existing release lines as well as the very next (i.e. 24.x) will keep it as experimental.
    2. Phase out: stop distributing Corepack (i.e. the distribution will no longer contain a corepack executable) on future release lines of Node.js – existing release lines will keep it as experimental.
    3. Status Quo: keep distributing Corepack with Node.js, experimental and disabled (i.e. only the corepack executable in the distribution), exactly as it is today.
    4. Stable and Disabled: keep distributing Corepack disabled (i.e. only the corepack executable in the distribution), and mark it stable in a future release line.
    5. Stable and Enabled: keep distributing Corepack with Node.js, enabled (i.e. corepack, pnpm, and yarn executables in the distribution), and mark it stable in a future release line.
    1. Stable and Disabled: keep distributing Corepack disabled (i.e. only the corepack executable in the distribution), and mark it stable in a future release line and Stable and Enabled: keep distributing Corepack with Node.js, enabled (i.e. corepack, pnpm, and yarn executables in the distribution), and mark it stable in a future release line.
    2. Phase out: stop distributing Corepack (i.e. the distribution will no longer contain a corepack executable) on future release lines of Node.js – existing release lines will keep it as experimental and Phase out later: stop distributing Corepack (i.e. the distribution will no longer contain a corepack executable) on future (i.e. 25+) release lines of Node.js – existing release lines as well as the very next (i.e. 24.x) will keep it as experimental.
    3. Status Quo: keep distributing Corepack with Node.js, experimental and disabled (i.e. only the corepack executable in the distribution), exactly as it is today.
    1. Phase out: stop distributing Corepack (i.e. the distribution will no longer contain a corepack executable) on future release lines of Node.js – existing release lines will keep it as experimental.
    2. Phase out later: stop distributing Corepack (i.e. the distribution will no longer contain a corepack executable) on future (i.e. 25+) release lines of Node.js – existing release lines as well as the very next (i.e. 24.x) will keep it as experimental.
    3. Stable and Disabled: keep distributing Corepack disabled (i.e. only the corepack executable in the distribution), and mark it stable in a future release line.
    4. Stable and Enabled: keep distributing Corepack with Node.js, enabled (i.e. corepack, pnpm, and yarn executables in the distribution), and mark it stable in a future release line.
    5. Status Quo: keep distributing Corepack with Node.js, experimental and disabled (i.e. only the corepack executable in the distribution), exactly as it is today.
  5. Abstained.

    1. Phase out later: stop distributing Corepack (i.e. the distribution will no longer contain a corepack executable) on future (i.e. 25+) release lines of Node.js – existing release lines as well as the very next (i.e. 24.x) will keep it as experimental.
    2. Phase out: stop distributing Corepack (i.e. the distribution will no longer contain a corepack executable) on future release lines of Node.js – existing release lines will keep it as experimental.
    3. Stable and Disabled: keep distributing Corepack disabled (i.e. only the corepack executable in the distribution), and mark it stable in a future release line.
    4. Status Quo: keep distributing Corepack with Node.js, experimental and disabled (i.e. only the corepack executable in the distribution), exactly as it is today.
    5. Stable and Enabled: keep distributing Corepack with Node.js, enabled (i.e. corepack, pnpm, and yarn executables in the distribution), and mark it stable in a future release line.
    1. Phase out: stop distributing Corepack (i.e. the distribution will no longer contain a corepack executable) on future release lines of Node.js – existing release lines will keep it as experimental.
    2. Phase out later: stop distributing Corepack (i.e. the distribution will no longer contain a corepack executable) on future (i.e. 25+) release lines of Node.js – existing release lines as well as the very next (i.e. 24.x) will keep it as experimental.
    3. Stable and Disabled: keep distributing Corepack disabled (i.e. only the corepack executable in the distribution), and mark it stable in a future release line and Status Quo: keep distributing Corepack with Node.js, experimental and disabled (i.e. only the corepack executable in the distribution), exactly as it is today.
    4. Stable and Enabled: keep distributing Corepack with Node.js, enabled (i.e. corepack, pnpm, and yarn executables in the distribution), and mark it stable in a future release line.
    1. Stable and Enabled: keep distributing Corepack with Node.js, enabled (i.e. corepack, pnpm, and yarn executables in the distribution), and mark it stable in a future release line.
    2. Stable and Disabled: keep distributing Corepack disabled (i.e. only the corepack executable in the distribution), and mark it stable in a future release line.
    3. Phase out later: stop distributing Corepack (i.e. the distribution will no longer contain a corepack executable) on future (i.e. 25+) release lines of Node.js – existing release lines as well as the very next (i.e. 24.x) will keep it as experimental and Phase out: stop distributing Corepack (i.e. the distribution will no longer contain a corepack executable) on future release lines of Node.js – existing release lines will keep it as experimental.
    4. Status Quo: keep distributing Corepack with Node.js, experimental and disabled (i.e. only the corepack executable in the distribution), exactly as it is today.
    1. Phase out later: stop distributing Corepack (i.e. the distribution will no longer contain a corepack executable) on future (i.e. 25+) release lines of Node.js – existing release lines as well as the very next (i.e. 24.x) will keep it as experimental and Phase out: stop distributing Corepack (i.e. the distribution will no longer contain a corepack executable) on future release lines of Node.js – existing release lines will keep it as experimental.
    2. Status Quo: keep distributing Corepack with Node.js, experimental and disabled (i.e. only the corepack executable in the distribution), exactly as it is today.
    3. Stable and Enabled: keep distributing Corepack with Node.js, enabled (i.e. corepack, pnpm, and yarn executables in the distribution), and mark it stable in a future release line and Stable and Disabled: keep distributing Corepack disabled (i.e. only the corepack executable in the distribution), and mark it stable in a future release line.
  6. Abstained.

  7. Voted for Stable and Enabled: keep distributing Corepack with Node.js, enabled (i.e. corepack, pnpm, and yarn executables in the distribution), and mark it stable in a future release line.

@mon-jai
Copy link

mon-jai commented Mar 19, 2025

Will corepack stay maintained or be deprecated?

@marco-ippolito
Copy link
Member

Will corepack stay maintained or be deprecated?

It will not be deprecated, simply will not be distributed along with Node.js but needs to be installed separately

@aduh95
Copy link
Contributor

aduh95 commented Mar 19, 2025

Will corepack stay maintained or be deprecated?

It will not be deprecated, simply will not be distributed along with Node.js but needs to be installed separately

To clarify, it could be deprecated at some point, that vote does not define anything about deprecation status of Corepack, only how it is distributed. That being said, there are no plans to deprecate Corepack at the moment, and in any case, it will be maintained at least as long as Node.js 24.x is not EOL.

@johnpyp
Copy link

johnpyp commented Mar 19, 2025

Are there any further details on the decision or discussion here?

Copy link
Member

@mhdawson mhdawson left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@joyeecheung
Copy link
Member

joyeecheung commented Mar 19, 2025

Are there any further details on the decision or discussion here?

More context is in the PR that triggered the voting automation:

#1527

Which also contains some links to other older discussions either directly or indirectly...

On a side note, maybe the automation should include a link to the vote proposal PR in the actual voting PR, I had to dig this one up from the search because the proposal PR was quite old since it dragged on for ~1y. I added at least #1527 to the top of this PR in case it appears to be coming out of nowhere (although, that PR also appeared to be coming out of nowhere due to the lack of links in the OP even though it was triggered by a bunch of other discussions that I cannot dig the links up easily now because they are scattered across multiple repos IIRC)

@aduh95 aduh95 merged commit dc5595e into main Mar 19, 2025
@aduh95 aduh95 deleted the votes/e4f313dc-6121-47bb-830d-d85f80d6ee33 branch March 19, 2025 23:47
@guiyumin
Copy link

will corepack be distributed as a standalone library ?

@wojtekmaj
Copy link

@guiyumin It already is.

@davidmurdoch
Copy link

Should Corepack stay in the Node.js distribution?

"Yes, it should stay." - literally everyone that isn't one of the Participants on this call.

@nodejs nodejs locked as resolved and limited conversation to collaborators Mar 20, 2025
@jasnell
Copy link
Member

jasnell commented Mar 20, 2025

Given that this issue is likely to attract a number of possibly heated comments from the ecosystem, I'm locking and limiting discussion on the thread to collaborators only.

The TSC recognizes that some subset of Node.js users will be disappointed by the outcome here... honestly there was a fair amount of disagreement among collaborators on this which is why it had to go to a TSC vote in the first place. However, the decision has been made and we're progressing along those lines.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet