
Research
/Security News
Shai Hulud Strikes Again (v2)
Another wave of Shai-Hulud campaign has hit npm with more than 500 packages and 700+ versions affected.
@esy-nightly/esy
Advanced tools
package.json workflow for native development with Reason/OCaml
This README serves as a development documentation for esy. For user documentation refer to esy.sh documentation site.
The following snippet lists esy repository structured (omitting irrelevant or obvious items) with further explanations:
βββ CHANGELOG.md
βββ LICENSE
βββ README.md
β
βββ Makefile
β Common tasks and workflows for esy development.
β
βββ bin/esy
β symlink (wrapper on Windows) for esy command, used for running tests
β
βββ bin/esyInstallRelease.js
β postinstall step for npm releases produced with `esy npm-release`
β command. This is a built JS file which is developed in a separate flow
β inside `esy-install-npm-release/` subdirectory (see below).
β
βββ docs
β esy end user documentation in markdown format.
β
βββ dune
βββ dune-project
β
βββ esy
β This dune library implements sandbox builder - a routine which builds
β the entire dependency graph and provides other introspection APIs.
β
βββ esy/bin
β This dune executable implements "esy" command.
β
βββ esy-solve
β This dune library implements solver.
β
βββ esy-fetch
β This dune library implements installer - fetching and installing of package sources
β
βββ esy-build-package
β This dune library implements package builder. esy library uses this to
β build each package.
β
βββ esy-build-package/bin
β This dune executable implements "esy-build-package" command.
β
βββ esy-install-npm-release
β Sources for `bin/esyInstallRelease.js`.
β
βββ esy-command-expression
β Parser for #{...} syntax used in esy manifests.
β
βββ esy-shell-expansion
β A simple shell expansion.
β
βββ esy-lib
β A collection of utility modules shared between other libraries.
β
βββ site
β Sources for https://esy.sh
β
βββ esy.lock
β Lock files. Esy uses itself for development
β
βββ package.json
β Manifest for yarn to manage NPM dependencies of this project
β
βββ scripts
β
βββ test
β Unit tests.
β
βββ test-e2e-slow
β End-to-end test suite which takes a significant amount of time since they're
β not mocked or rarely so.
β We execute it on CI by placing `@slowtest` token in commit messages.
β
βββ test-e2e
End-to-end test suite that dont need the network. Heavily mocked
To make changes to esy and test them locally:
% git clone --recurse-submodules git://github.com/esy/esy.git
% cd esy # Change to the cloned directory
% esy # install and build dependencies
And then run newly built esy executable from anywhere by adding PATH_TO_REPO/_build/install/default/bin
to the $PATH during the shell's session. On Windows, append PATH_TO_REPO/bin too.
bin/esyInstallRelease.jsbin/esyInstallRelease.js is developed separately within the esy-install-npm-release/ directory.
Run:
% make bin/esyInstallRelease.js
to update the bin/esyInstallRelease.js file with the latest changed, don't
forget to commit it.
esy has primarily 3 kinds of tests.
These are present inline in the *.re files. To run them,
esy b dune runtest
These are present in test-e2e folder and are written in JS. They're run by jest
yarn jest
They're present in test-e2e-slow and are written in JS. They're supposed to mimick the user's workflow
as closely as possible.
By placing @slowtest token in commit messages, we mark the commit ready for the slow tests framework
(tests that hit the network). They are run with node test-e2e-slow/run-slow-tests.js
In cases e2e tests fail with Host key verification failed., you might have to create ssh keys
in the cygwin shall and add them to your github profile.
.\node_modules\esy-bash\re\_build\default\bin\EsyBash.exe bash
ssh-keygen
Add the public key to you Github profile
Add the following to the bash rc of the cygwin instance
eval $(ssh-agent -s)
ssh-add ~/.ssh/id_rsa
There are two branches:
master β the active development, we cut new versions out of there regularly.0.0.x β maintainance branch for 0.0.x releases.0.2.x β maintainance branch for 0.2.x releases.0.3.x β maintainance branch for 0.3.x releases.To make changes to esy.sh:
% make site-bootstrap
% make site-start
% make site-publish
Issues are tracked at esy/esy.
esy is released on npm.
Because esy is written in OCaml/Reason and compiled into a native executable we need to acquire a set of prebuilt binaries for each supported platform (Windows, macOS and Linux). We employ CI servers (thanks Azure) to build platform specific releases.
The release workflow is the following:
Ensure you are on master branch and assuming you want to release the
version currently defined in package.json (see step 6.), run
% make release-tag
% git push && git push --tags
Wait till CI finishes its task and release @esy-nightly/esy package.
You can test it manually.
Run
% make release-prepare
which downloads the nightly corresponding to the current commit working
directory is at and "promotes" it to a release. It will create
_release/package directory.
Ensure release inside _release/package directory is ok.
You can cd _release/package && npm pack && npm install -g ./esy-*.tgz to test how
release installs and feels.
Run
% make release-publish
to upload the release on npm.
Use
% make NPM_RELEASE_TAG=next release-publish
to publish the release under next tag (so users won't get it automatically but
only explicitly requested).
Bump version in package.json to the next patch version.
We expect the next version to be mostly a patch version. In case you want to release new minor or major version you need to bump it before the release.
FAQs
Package builder for esy.
The npm package @esy-nightly/esy receives a total of 33 weekly downloads. As such, @esy-nightly/esy popularity was classified as not popular.
We found that @esy-nightly/esy demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago.Β It has 0 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Another wave of Shai-Hulud campaign has hit npm with more than 500 packages and 700+ versions affected.

Product
Add real-time Socket webhook events to your workflows to automatically receive software supply chain alert changes in real time.

Security News
ENISA has become a CVE Program Root, giving the EU a central authority for coordinating vulnerability reporting, disclosure, and cross-border response.