replace download with alternate package

[itsspriyansh]

No description provided.

[itsspriyansh]

1. The person who created the fork (as mentioned in issue Find a replacement for download package #12) has published his code to npm. His package is called @xhmikosr/downloader. We can either download his package or install his fork itself. But here the issue is that we don't have any type declarations for @xhmikosr/downloader. If we rather install his fork directly, the folder structure inside node_modules remains same and only the code gets udpated inside the exact same file as earlier. So in this case maybe the older type declarations might work. However, on doing this, I faced this error in the below image.
   
   We can have a workaround for this by specifying the type ourselves like this: function(progress: {percent: number}).

2. In this new patch of the download package, the code has been switched to ES module leading to this error when running the script.
   
   Can we use dynamic import here to keep commonjs compatibility?

[garg3133]

only the code gets udpated inside the exact same file as earlier. So in this case maybe the older type declarations might work.

This is happening because you are using the dev branch instead of the master branch. But we should ideally use the master branch only because otherwise we'll miss out on all the updates that have taken place there. And if after sometime we get another vulnerability, we anyways would need to move to the latest branch.

For the types, we might need to define them ourselves inside the project.

Can we use dynamic import here to keep commonjs compatibility?

Yes, we would need to do that only.

[garg3133]

You can also look into other similar packages like node-downloader-helper. Since we'd need to do some work to keep the original download package as well, if you find moving to the node-downloader-helper to be easier that this effort, we can consider that as well.

I've used node-downloader-helper package in https://github.com/nightwatchjs/nightwatch-setup-tools to download sample mobile apps when doing the initial setup using the npm init nightwatch command.

[itsspriyansh]

@garg3133 I have updated the PR. I would like to know if this kind of approach will work. What I have done here is:

1. Replaced the download package with node-downloader-helper.
2. I have observed that the node-downloader-helper doesn't come with decompress feature. So I have tried implementing it in our wrapper function itself.
3. Since the end event of DownloaderHelper triggers immediately after the download is finished and the wrapper function returns at the same time, the files won't be decompressed and the code would break after installing cmdline-tools since we are modifying the folder structure of cmdline-tools immediately after the installation. To handle this, I have used Promise to handle asynchronous operations.
4. After testing this, the code successfully downloads SDK from scratch without any issue.