npmjs not bundled with Windows exe

[EmperorArthur]

Issue

This package can only be installed if the developer or ci/cd system has a working C++ compiler.

Not all developers have C++ compilers installed. Especially on Windows. Even when we use Visual Studio, the C++ component is not always installed.

This is an unmarked dependency.

Security Considerations

Pre-compiled code is no less risky than bundled and minified TypeScript. Developers are already trusting package maintainers, and there is minimal additional risk.

[addaleax]

@EmperorArthur I'd say this is a bit of a "pull requests welcome" situation – we don't provide prebuilds right now, but we know it's a common feature for native addons that would be totally fine to add.

That being said, I'd imagine that https://nodejs.org/api/tls.html#tlsgetcacertificatestype will potentially replace this package in the long run.

[EmperorArthur]

@addaleax This is far from being replaced. That function only exports the certs, and I've seen no indication they're working on allowing keys to be exported, or allowing more granular cert location control.

I'll see what I can do once I have a C++ compiler available. Until then anything I do would just be guessing.

Right now it looks like the best approach is what win-ca did.

1. Create a library version for 32 bit and 64 bit Windows.
2. Determine at runtime which to use.
3. Include both the compiled files in package.json

[addaleax]

@EmperorArthur Well, yeah, we're not planning on abanadoning this project just yet either :) It's more of a long-term consideration.

We do maintain some other native addons in our department, some of which have a prebuild setup like https://github.com/mongodb-js/kerberos that seems to work quite well overall, using the prebuild and prebuild-install packages, so that's probably the direction we'd go in if we implemented this ourselves.

(Also maybe noteworthy – legally, we can only accept code from external contributors who have signed our CLA. The code of course remains open source, though.)

[EmperorArthur]

@addaleax I understand about the CLA. Unfortunately my company doesn't even have a policy on open source contributions. Before I can sign something like that, I need to find who internally can approve it.

The joys of corporate life. I can do everything down to giving the exact line number and change to be made, but can't do it myself without the paperwork.