Building pnpm from source (without pnpm)

[taylorjdawson]

We are looking to build pnpm from source, however, it looks like you need pnpm to build pnpm. Is there a way for us to build pnpm without using pnpm? This is a boot strapping issue.

I couldn't locate in the repo the code for the pnpm compile command if someone could point me to where that is.

[zkochan]

No, I don't think you could. But you can do npx pnpm install and so on. So technically you wouldn't install pnpm just run npx.

[rastagraffix]

This all assumes there is already a pre-built package. For OpenBSD, there isn't. That's why we need to figure out how to build this monster from scratch.

[lrvick]

This would not be a solution at any of the orgs I support, or in the Linux distro I maintain, which all have supply chain integrity standards that forbid trusting third party compiled binaries. How would anyone know that binary you upload was not tampered with?

There must be a way to bootstrap pnpm from source. How was the first version of pnpm built?

[rastagraffix]

I have already downloaded the source code. The issue is THERE ARE NO INSTRUCTIONS ON HOW TO BUILD IT.

I don't know how to make this any simpler or clearer.

[konsolebox]

@zkochan Why does building of pnpm have to be cryptic? Is there a step that shouldn't be publicized?

[zkochan]

I have already downloaded the source code. The issue is THERE ARE NO INSTRUCTIONS ON HOW TO BUILD IT.
I don't know how to make this any simpler or clearer.

You cannot build pnpm without using pnpm. How can I be any simpler or clearer?

[zkochan]

This would not be a solution at any of the orgs I support, or in the Linux distro I maintain, which all have supply chain integrity standards that forbid trusting third party compiled binaries. How would anyone know that binary you upload was not tampered with?

The npm registry has added support for provenance and OIDC. We will configure that for pnpm

[orsolic]

One year later - is it possible to build pnpm from source (preferably on FreeBSD)?

[zkochan]

No, you cannot build pnpm without using pnpm.