Why do we depend on a global ios-deploy?

[apache]

Why do we depend on a global ios-deploy?

[brodybits]

There were 2 reasons we did not explicitly depend on ios-deploy in the past ([1]):

• viral license
• possible Xcode version mismatch

[1] https://lists.apache.org/thread.html/8f01ff201d46dce3fadec5479fd715b96f8b366aac38b4dd2cdfe411@%3Cdev.cordova.apache.org%3E

[janpio]

Weren't there problem with installing packages locally with npm on Windows and then being able to execute them? Most CLI like tools installed via npm used to use -g as an option...

[oliversalzburg]

@janpio Yes, I think there were issues in the past, but those should really be in the past. Executable npm modules should all register entrypoints in node_modules/.bin/ and should generally be easily invokable from there. If everything else fails, I think npx is widely accepted as a solution in this regard.

[janpio]

Afaik Cordova support much older versions of node/npm than those that first added a stable version of npx.

But in general it would of course be better, to have a local dependency on ios-deploy than the current state. Could also get rid of that code that gives you the error message then. I think we would be very happy in merging a PR that changes this.

[brodybits]

Viral license was especially bad in the past when "we" had to include dependencies in the bundle. (I was not part of the "we" before 2018.)

This should no longer be necessary in next major release where we are dropping Node.js 4 support. But it may still be an issue to add such a dependency in an Apache project. I would also personally downvote such an explicit dependency due to the viral license.

Sorry I took so long to compose the response.

[oliversalzburg]

@brodybits You would be opposed to adding an ios-deploy dependency to cordova because ios-deploy uses a problematic license? Why? And why is it then fine to still rely on it?

Sorry, just read #420 (comment), which already makes it a bit clearer. I would still love to hear your reasoning behind it though.