mirror nodejs.org/dist to iojs.org/dist

[isaacs]

It would be a lot easier for npm/nave/n if the nodejs.org/dist folder were mirrored at iojs.org/dist.

Would be a pretty simple one-time wget fetch. Any objections?

[isaacs]

Also, are there any legal reasons why that would be a bad idea? The MIT license specifically allows redistribution, right?

[snostorm]

Short-term, this would work (as io.js will never have a version now that is < 1.0.0) but what if Node.js were to decide to re-brand and release the long promised v0.12.0 as v1.0.0 next week? Now we have conflicting and overlapping version numbers.

It is probably better, long term, to have n, nvm, nave, etc. just support tracking individual projects just like how in the Ruby community rvm makes it easy to swap between different interpreters. Let users set a default and eventually choose one project or another to be the default.

[isaacs]

@snostorm I am in regular communication with @shammond2000 and @tjfontaine, and I think the possibility of a collision there is extremely unlikely.

v0.12 will release as v0.12, and the road forward is to eventually merge the projects. Everyone is aligned on that as a goal.

[ljharb]

If this does happen, this will affect nvm version listings as well, which currently are (being) built to support two separate remote calls. Doing this in a nonbreaking way is ideal.

[cjihrig]

Closing this, as I think we are more or less mirroring the directory, and a few version managers have added io.js support. Let me know if we need to reopen this.

[ljharb]

The only thing left as far as http://nvm.sh is concerned is #368 - i'd prefer it if iojs.org also had "SHASUMS.txt", and it would allow nvm to have checksum support more easily.

[bnoordhuis]

@ljharb There's a (signed) SHASUMS256.txt. Doesn't that work?

[ljharb]

@bnoordhuis #368 describes the problem - not every system nvm supports has SHA-256 available. I'd really prefer it if both SHA1 and SHA256 were available.

Is there a practical risk from SHA1 collision on a middleman-d tar download (where they hadn't already middlemann-d the checksum file), that doesn't exist with SHA256?