![Maven Central Adds Sigstore Signature Validation](https://cdn.sanity.io/images/cgdhsj6q/production/7da3bc8a946cfb5df15d7fcf49767faedc72b483-1024x1024.webp?w=400&fit=max&auto=format)
Security News
Maven Central Adds Sigstore Signature Validation
Maven Central now validates Sigstore signatures, making it easier for developers to verify the provenance of Java packages.
create-pure
Advanced tools
pure | 📦
code style | standard
Minimalistic template to generate low maintenence JS modules
An opinionated template to optimize workflow for stressed out minimalists.
The template is intended for modules whose main purpose is to export functionality and are published to a public registry.
(Don't use this for your main project, you'll most likely regret it)
Features
npm init pure my-awesome-module
That's it.
$ tree my-awesome-module
my-awesome-module/
├── .editorconfig
├── .gitignore
├── LICENSE
├── README.md
├── index.js
├── package.json
└── test.js
Zero conf? I lied, there is some "configuration".
If the following options do not satisfy your cutomization needs then fork off!
No seriously fork this repo, edit the Templates section of this README.md
and use it with:
$ npm init username/pure my-awesome-module
REPO_PREFIX
git config --global npm.repoPrefix "https://github.com/telamon"
AUTHOR
git config --global user.name "First Last"
git config --global user.email "username@provider.tld"
DONATION_TEXT
git config --global npm.donation ~/Documents/advertisment.md
This section contains the contents for all files that this template generates. The generation code is located in index.js
.gitignore
This is an exhaustive list of permitted files, if you feel that something is missing then don't hesitate to ask.
# Reverse policy .gitignore
*
!README.md
!LICENSE
!package.json
!index.js
!test.js
!.editorconfig
index.js
// SPDX-License-Identifier: LICENSE_SPDX
test.js
const test = require('tape')
test('desc', t => {
t.end()
})
.editorconfig
root = true
[*]
indent_style = space
indent_size = 2
end_of_line = lf
charset = utf-8
trim_trailing_whitespace = true
insert_final_newline = true
README.md
[`pure | 📦`](https://github.com/telamon/create-pure)
[`code style | standard`](https://standardjs.com/)
# MODULE_NAME
> MODULE_DESC
## Use
BBQbash
$ npm install MODULE_NAME
BBQ
BBQjs
const mod = require('MODULE_NAME')
mod.doMagic() // => Result
BBQ
## Donations
DONATION_TEXT
## Changelog
### 0.1.0 first release
## Contributing
By making a pull request, you agree to release your modifications under the license stated in the next section.
Only changesets by human contributors will be accepted.
## License
[LICENSE_SPDX](./LICENSE)
AUTHOR 🄯 YEAR
LICENSE
TODO: Multiple choice prompt
Only AGPL available right now cause that's the one I use. Open an issue if you need something else. :thumbsup:
LICENSE_TEXT
package.json
TODO:
test
and debug
optional via git.config{
"name": "MODULE_NAME",
"version": "0.1.0",
"description": "MODULE_DESC",
"main": "index.js",
"scripts": {
"lint": "standard",
"test": "tape test.js",
"debug": "node inspect $(npm bin)/tape test.js",
"prepublishOnly": "standard && npm test"
},
"repository": {
"type": "git",
"url": "git://REPO_PREFIX/MODULE_NAME"
},
"author": "AUTHOR",
"license": "LICENSE_SPDX",
"bugs": {
"url": "REPO_PREFIX/MODULE_NAME"
},
"homepage": "REPO_PREFIX/MODULE_NAME"
}
I am exploring the effects of
echo '*' > .gitignore
Imagine that instead of publishing a piece of functionality, you're building a time-capsule. There's no way to tell when or who will stumble upon it's contents nor to what ends it will be used.
Ask yourself, if your current commit were to be visited 10 years from now how much of the looks and function will have survived the rot and decay of time?
Also new repositories are created every second, there is a real risk that your repo might not be visited for another couple of years or even during your lifespan.
The fear of low popularity drives some us to extensivly decorate our repositories with integrations, badges, remotely linked images.
It's a special kind of madness called "Marketing". It costs effort, dosen't really help indexing and in the end only produces more noise for the visitor.
I want to try a different strategy - I believe that the code is the most significant component of any repository and the only piece that should be worth the effort.
§1 A Git repository is an interdimensional holy ground, period.
It is a shared resource between you and countless other individuals present and future - each with their own configurations, workflows, tooling, integrations and platforms.
The more you add the more you commit to maintain
§2 The code that is exported must be the same that is written
Transpilation in modules sucks so much it deserves at least 3 separate articles of it's own. Please stop publishing modules written with X but exporting Y. It messes up introspection, consistency and all in all just makes your module more time sensitive.
§3 Avoid redundant links to external resources
If a dependency is not central to your modules function then leave it out.
Consider exporting a lower level interface with zero dependencies rather than a high-level-does-it-all with the help of external deps.
Adding dependencies is the easy part, getting rid of them is a great incentive to fork.
To be human is to err and find compromise. If you're using this template or make an honest attempt to follow the proposed guidelines then you deserve the badge of purity!
Behold the anti-badge-badge!
With this we can proudly show that once again hypocrisy and ideals go hand in hand.
On a sidenote: I've "purified" that badge, it comes at the cost of reduced visual quality but with improved anonymity and I am confident that the looks wont degrade much in the years to come.
P.S. On the subject of emoji I am stumped. Hieroglyphs have previously shown great resillience and these ones are even standardized. Decide for yourself
Plain ASCII badge:
1.1.0
By making a pull request, you agree to release your modifications under the license stated in the next section.
Only changesets by human contributors will be accepted.
Tony Ivanov 🄯 2020
FAQs
Template to generate low maintenence JS modules
The npm package create-pure receives a total of 0 weekly downloads. As such, create-pure popularity was classified as not popular.
We found that create-pure demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Maven Central now validates Sigstore signatures, making it easier for developers to verify the provenance of Java packages.
Security News
CISOs are racing to adopt AI for cybersecurity, but hurdles in budgets and governance may leave some falling behind in the fight against cyber threats.
Research
Security News
Socket researchers uncovered a backdoored typosquat of BoltDB in the Go ecosystem, exploiting Go Module Proxy caching to persist undetected for years.