Support reproducible offline source packaging (e.g., for Homebrew)

[cbrnr]

I am currently preparing a source-built Quarto formula for Homebrew. The formula already builds successfully and runs Quarto with Homebrew's current dependencies on my local Mac:

• Deno 2.9.6
• Pandoc 3.11
• Dart Sass 1.104.1
• esbuild 0.28.2
• Typst 0.15.1
• Node 26.8.2
• Rust 1.98.1

There are certainly several issues I still need to address before even thinking about submitting a new formula to Homebrew, but I wanted to take the opportunity to discuss potential changes to Quarto first, which would make creating a formula much easier (this would not only benefit a Homebrew formula, but likely also other packaging systems like Conda and various Linux distributions).

The three most important changes would be:

1. Replace the obsolete Deno vendoring commands (Deno 2.9 does not support the current use of deno install anymore but a corresponding deno cache can be used instead), include all six entrypoints (package/src/bld.ts and tools/deno-esbuild-bundle.ts are missing), and stop suppressing errors (i.e., don't do set +e).
2. Add and enforce a Deno lock file.
3. Stop checking for typst-gather before it is actually needed.

There are some additional (minor) things that Quarto could do, but I would like to discuss if you are open to these changes in principle. If so, I'm happy to talk about the other changes that, together with the three mentioned points, would not change Quarto's behavior at all, but make building from source much easier (and eventually enable a core Homebrew formula).

[mcanouil]

Please follow this repository's contributing guidelines.

Transferring to discussion feature requests.

FYI, there is a homebrew cask: https://formulae.brew.sh/cask/quarto#default

[cbrnr]

Quarto should be available as a regular formula and not a cask, as it is a command line tool. Thanks for transferring this issue to a discussion, I'm looking forward to your input.

[cbrnr]

I've created a Homebrew formula that builds Quarto from source against Homebrew's shared dependencies (Deno, Pandoc, Dart Sass, esbuild and Typst). Unlike the cask, it also works on Linux. You can try it with brew install cbrnr/tap/quarto (uninstall the cask first).

To get it into homebrew-core, it needs a Deno lockfile (at the moment the Deno dependencies are fetched without pinning or integrity checks, and Homebrew won't accept that). Could you add that?

I also had to work around three small things in the build scripts. I'm happy to send PRs for them if you're open to that:

• vendor.sh: the deno install calls fail silently on current Deno. deno cache works, and then set +e can go.
• configure checks for typst-gather on PATH, which isn't needed.
• $QUARTO_DIST_PATH/bin should be created before copyQuartoScript.

[cbrnr]

Just in case you haven't seen this post, @cderv or @cscheid do you have any opinion? I know that the v2 rewrite is in the works, but v1.x will probably stay relevant for at least another year, so in my opinion creating a Homebrew formula for it would still be very nice (I'd also be happy to help creating the formula for v2 when it is ready). The only blocker is the missing Deno lock file, and the three smaller things are totally optional (see my previous post).

[cscheid]

Yes, I think we should support that. Would you be willing to open a PR with everything that you need added? We'll take a look at it.

[cbrnr]

This sounds great! Yes, I can submit a PR soon! Thank you for your response!

[cderv]

Thanks for the details. About the deno install failure in vendor.sh: we hit it ourselves when updating Quarto to Deno 2.9.8 in #15186 (released in 1.11.8). Deno 2.9 rejects permission flags on a non-global deno install, and we were passing --allow-all:

error: Note: Permission flags can only be used in a global setting

Because of set +e, configure finished without the cache being filled. We now pass --allow-import, which Deno 2.9 accepts:

quarto-cli/package/scripts/vendoring/vendor.sh

Lines 25 to 29 in adcf629

	set +e
	for entrypoint in quarto.ts vendor_deps.ts ../tests/test-deps.ts ../package/scripts/deno_std/deno_std.ts; do
	$DENO_BIN_PATH install --allow-import --no-config --entrypoint $entrypoint "--importmap=$QUARTO_SRC_PATH/import_map.json"
	done
	set -e

Your formula builds 1.10.19, which still has --allow-all, so that explains what you saw. Just a heads-up: main is now on Deno 2.9.8 (see configuration), so the deno install calls should work again there with Homebrew's Deno.

The set +e (and the || continue in vendor.cmd) is still there though, so the next Deno change of this kind would fail silently again. Removing it fits well with the lockfile work, as --frozen would not stop the build otherwise.

[cbrnr]

See #15259.