# Why are updates to the official npm package coming out of an obscure branch on not the official repo?

**URL:** <https://discourse.elm-lang.org/t/why-are-updates-to-the-official-npm-package-coming-out-of-an-obscure-branch-on-not-the-official-repo/2994>\
**Category:** Learn\
**Created:** [January 22, 2019, 4:57pm UTC](https://discourse.elm-lang.org/t/why-are-updates-to-the-official-npm-package-coming-out-of-an-obscure-branch-on-not-the-official-repo/2994 "2019-01-22T16:57:34Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![itsgreggreg](https://yyz1.discourse-cdn.com/flex035/user_avatar/discourse.elm-lang.org/itsgreggreg/32/462_2.png) [@itsgreggreg](https://discourse.elm-lang.org/u/itsgreggreg)\
**Post date:** [January 22, 2019, 4:57pm UTC](https://discourse.elm-lang.org/t/why-are-updates-to-the-official-npm-package-coming-out-of-an-obscure-branch-on-not-the-official-repo/2994/1 "2019-01-22T16:57:34Z")

</div>

“0.19.0-bugfix6”

> **[elm](https://www.npmjs.com/package/elm)**
>
> The Elm Platform: Binaries for the Elm programming language.

> <https://github.com/rtfeldman/elm-compiler/commits/update-binwrap-0.2.0>

This makes it essentially impossible to go from the NPM page and find the actual source of the package you’re downloading. Doesn’t seem like a great trust building practice for open source software.

---

<div class="post-metadata">

**Author:** ![rtfeldman](https://yyz1.discourse-cdn.com/flex035/user_avatar/discourse.elm-lang.org/rtfeldman/32/50_2.png) [@rtfeldman](https://discourse.elm-lang.org/u/rtfeldman)\
**Post date:** [January 22, 2019, 8:20pm UTC](https://discourse.elm-lang.org/t/why-are-updates-to-the-official-npm-package-coming-out-of-an-obscure-branch-on-not-the-official-repo/2994/2 "2019-01-22T20:20:10Z")

</div>

> [@itsgreggreg](#):
>
> This makes it essentially impossible to go from the NPM page and find the actual source of the package you’re downloading. Doesn’t seem like a great trust building practice for open source software.

The npm package uses [`binwrap`](https://github.com/avh4/binwrap) to download and install binaries built from `elm/compiler`. The binaries are built elsewhere; you can’t audit the source of where they came from regardless.

Honestly, if you have any trust concerns at all about the npm installer, the smart move is not to use it. The binaries are available from [elm-lang.org/installers](http://elm-lang.org/installers), or if you have trust concerns with those, you can always build them from source.

---

<div class="post-metadata">

**Author:** ![harrysarson](https://yyz1.discourse-cdn.com/flex035/user_avatar/discourse.elm-lang.org/harrysarson/32/1305_2.png) [@harrysarson](https://discourse.elm-lang.org/u/harrysarson)\
**Post date:** [January 23, 2019, 12:44am UTC](https://discourse.elm-lang.org/t/why-are-updates-to-the-official-npm-package-coming-out-of-an-obscure-branch-on-not-the-official-repo/2994/4 "2019-01-23T00:44:39Z")

</div>

When I upgrade a dependency on npm I do like to look at the changelog and also the git commit history. There is a pull request ([https://github.com/elm/compiler/pull/1884](https://github.com/elm/compiler/pull/1884)) and once that lands npm and github will be in agreement.

However, currently the commits in the latest version on npm cannot be found in the github repository. Possibly, the release of this module should have been delayed until the pull request is merged?

---

<div class="post-metadata">

**Author:** ![glennsl](https://yyz1.discourse-cdn.com/flex035/user_avatar/discourse.elm-lang.org/glennsl/32/1496_2.png) [@glennsl](https://discourse.elm-lang.org/u/glennsl)\
**Post date:** [January 23, 2019, 1:03am UTC](https://discourse.elm-lang.org/t/why-are-updates-to-the-official-npm-package-coming-out-of-an-obscure-branch-on-not-the-official-repo/2994/5 "2019-01-23T01:03:28Z")

</div>

> [@rtfeldman](#):
>
> [elm-lang.org/installers](http://elm-lang.org/installers)

That link is dead. I think this is the page you mean: [Installation · An Introduction to Elm](https://guide.elm-lang.org/install.html)

---

<div class="post-metadata">

**Author:** ![jerith](https://yyz1.discourse-cdn.com/flex035/user_avatar/discourse.elm-lang.org/jerith/32/114_2.png) [@jerith](https://discourse.elm-lang.org/u/jerith)\
**Post date:** [January 26, 2019, 1:56am UTC](https://discourse.elm-lang.org/t/why-are-updates-to-the-official-npm-package-coming-out-of-an-obscure-branch-on-not-the-official-repo/2994/6 "2019-01-26T01:56:49Z")

</div>

It would also be helpful to know this information when deciding which commit hash to use in source-based distros – e.g. [the nixpkgs expression](https://github.com/NixOS/nixpkgs/blob/master/pkgs/development/compilers/elm/packages/elm.nix) for building Elm. We’d love to stay up-to-date, but it’s not always clear what kind of testing the commits at the tip of `master` have undergone! 🙂 (cc @domenkozar.)

---

<div class="post-metadata">

**Author:** ![harrysarson](https://yyz1.discourse-cdn.com/flex035/user_avatar/discourse.elm-lang.org/harrysarson/32/1305_2.png) [@harrysarson](https://discourse.elm-lang.org/u/harrysarson)\
**Post date:** [February 4, 2019, 11:28pm UTC](https://discourse.elm-lang.org/t/why-are-updates-to-the-official-npm-package-coming-out-of-an-obscure-branch-on-not-the-official-repo/2994/7 "2019-02-04T23:28:24Z")

</div>

Maybe this might possibly stay open a while longer in the vague hope of some more information or a resolution.

---

<div class="post-metadata">

**Author:** ![Jan\_Hrcek](https://yyz1.discourse-cdn.com/flex035/user_avatar/discourse.elm-lang.org/jan_hrcek/32/451_2.png) [@Jan\_Hrcek](https://discourse.elm-lang.org/u/Jan_Hrcek)\
**Post date:** [February 12, 2019, 7:03am UTC](https://discourse.elm-lang.org/t/why-are-updates-to-the-official-npm-package-coming-out-of-an-obscure-branch-on-not-the-official-repo/2994/8 "2019-02-12T07:03:58Z")

</div>

This is making me concerned too.  
I know about “batching” approach that Evan is advocating in his “Code is the easy part” and from experience we can all see that it leads to very nice results.

The reason it makes me concerned is that (as a Haskell hobbyist) I’d like to do some hacking on the compiler and use bits and pieces from the codebase to explore some tooling ideas.  
And since elm compiler is not released as a library on Hackage (I assume it’s because Evan doesn’t want people to depend on elm as a library, so that he has freedom to do changes)  
I have to rely on stack and depending on specific commits in the elm/compiler repo.

Please don’t take me wrong. I really like Elm.  
In fact I’ll be switching to a new job next month, where I’ll be programming Elm full time.  
I don’t want to start another flame like “elm development is not being transparent”.  
Instead I’d just like to kindly ask people from the core team to shed some light about what’s been happening recently and why we can’t see any commits landing in (any branches) of the elm/compiler repo.

---

<div class="post-metadata">

**Author:** ![luke](https://yyz1.discourse-cdn.com/flex035/user_avatar/discourse.elm-lang.org/luke/32/709_2.png) [@luke](https://discourse.elm-lang.org/u/luke)\
**Post date:** [February 12, 2019, 7:46am UTC](https://discourse.elm-lang.org/t/why-are-updates-to-the-official-npm-package-coming-out-of-an-obscure-branch-on-not-the-official-repo/2994/9 "2019-02-12T07:46:55Z")

</div>

The compiler doesn’t have any JavaScript components, and the npm installer is just for convenience. Any minor updates to it are just to make sure that it works correctly and doesn’t cause `npm audit` to report vulnerabilities. The “bugfix” identifier refers to bugs with installers. All updates to the compiler with any notable impact will be accompanied by an announcement on the blog. In the future we’ll do better to make sure that the repo reflects the latest npm version, but please be assured that those commits will be extremely uninteresting.

> I’d just like to kindly ask people from the core team to shed some light about what’s been happening recently and why we can’t see any commits landing in (any branches) of the elm/compiler repo.

Just a reminder that time and energy spent explaining things that are halfway finished is time and energy not spent actually finishing them, and the final outcome of a project will likely be quite different than how things look in earlier stages so it’s not actually useful information anyway.

Everyone is working hard on stuff and consulting directly with community members on relevant issues. If there are no commits in the compiler that just means there’s no code being written for the compiler. There are a lot of things to do other than writing code for the compiler so new commits is not really a good measure of productivity or a good window into current work.

I hope as a community we can continue to grow in our understanding of what it means to develop a language beyond writing code and pushing it to `elm/compiler`.

---

<div class="post-metadata">

**Author:** ![Jan\_Hrcek](https://yyz1.discourse-cdn.com/flex035/user_avatar/discourse.elm-lang.org/jan_hrcek/32/451_2.png) [@Jan\_Hrcek](https://discourse.elm-lang.org/u/Jan_Hrcek)\
**Post date:** [February 12, 2019, 11:07am UTC](https://discourse.elm-lang.org/t/why-are-updates-to-the-official-npm-package-coming-out-of-an-obscure-branch-on-not-the-official-repo/2994/10 "2019-02-12T11:07:12Z")

</div>

Thank you Luke for the nice explanation and for dispelling my concerns 🙂

---

<div class="post-metadata">

**Author:** ![luke](https://yyz1.discourse-cdn.com/flex035/user_avatar/discourse.elm-lang.org/luke/32/709_2.png) [@luke](https://discourse.elm-lang.org/u/luke)\
**Post date:** [February 12, 2019, 11:43pm UTC](https://discourse.elm-lang.org/t/why-are-updates-to-the-official-npm-package-coming-out-of-an-obscure-branch-on-not-the-official-repo/2994/11 "2019-02-12T23:43:20Z")

</div>

Closed on February 12, 2019, 11:43pm UTC