Need a packaging guide

[cyqsimon]

At this point yarn is independently packaged in almost every Linux distribution, see https://pkgs.org/search/?q=yarn. Hovever today I discovered, to my great surprise,that most if not all of them (including ArchLinux!) are still offering 1.22, which is very odd.

So naturally I submitted issues to the distros I use, and the good people at Fedora replied pretty quickly: https://bugzilla.redhat.com/show_bug.cgi?id=2227706#c1, saying that they "didn't really manage to understand how to build it from source". I linked to them an exampe of how an AUR package did it, but honestly its liberal use of cp -R * worries me. When I looked into the newest release tarball, it confused me whether the entry point should be directly packages/yarnpkg-cli/bin/yarn.js, or should it be scripts/bin/yarn, or should it be scripts/dist-scripts/yarn. I suspect the reason other distros haven't updated might be similar - they don't know what to do.

Therefore I think it would be a good idea for this repo to contain some kind of official documentation/recommendation/guides on how independent packagers should be packaging yarn 3.x. Thank you in advance for your effort.

[arcanis]

I'll make sure it's very clear in the next documentation, but the global Yarn (ie, the one used by distros) must remain Yarn 1.22. Modern releases of Yarn are installed on a per-project basis (just like any other dependency), not global to the system anymore (otherwise we'd break them for each major). Having a system one is still required, but only to act as an intermediary that runs the proper Yarn version for the current project.

I don't think distros should change the status of Yarn right now - in the future the system yarn binary will be intended to be provided as part of the Node releases themselves (as part of https://nodejs.org/api/corepack.html) rather than npm, but it's not fully stable yet. Until it is, I'd refrain from making any changes.

[manisandro]

Fedora yarn maintainer here. My main trouble with yarn 1.x is attempting to bump versions of dependencies to address vulnerabilities [1], but this is getting more and more complicated. Is there any chance upstream could ship a maintenance release which addresses these CVEs?

[1] https://bugzilla.redhat.com/buglist.cgi?bug_status=NEW&bug_status=ASSIGNED&bug_status=__closed__&classification=Fedora&columnlist=product%2Ccomponent%2Cassigned_to%2Cbug_status%2Cshort_desc%2Cchangeddate%2Cbug_severity&component=yarnpkg&order=status%2C%20assigned_to%2C%20id%2C%20&product=Fedora&query_format=advanced&short_desc=CVE&short_desc_type=allwordssubstr

[juxuanu]

I am the one that packaged it for AUR. I work with a large yarn monorepo at work and I still couldn't manage to understand how to generate an output to use as the "compiled" package, so I, as said, cp -R everything.

Hopefully a way to package it (maybe a script in package.json?) will be available.