The "has only bundled deps" check was short-circuiting logic too
early, causing the "nodejs(engine) == <ver>" dep to be missed,
which is still relevant even when bundling.
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Using --sort=name ensures that files are added to the tarball in a
predictable ordering. This should result in a consistent checksum
for the tarball and thus facilitate reproducibility for auditing
purposes.
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Node packages can have dependencies of the for "@group/package" instead of just "package".
Calling symlink() (and thus os.symlink()) in such a case fails when there is no "@group" directory yet.
```
+ /usr/lib/rpm/nodejs-symlink-deps /usr/lib/node_modules
ERROR: the path for dependency "@babel/runtime" already exists
This could mean that bundled modules are being installed. Bundled libraries are
forbidden in Fedora. For more information, see:
<https://fedoraproject.org/wiki/Packaging:No_Bundled_Libraries>
It is generally reccomended to remove the entire "node_modules" directory in
%prep when it exists. For more information, see:
<https://fedoraproject.org/wiki/Packaging:Node.js#Removing_bundled_modules>
If you have obtained permission from the Fedora Packaging Committee to bundle
libraries, please use `%nodejs_fixdep -r` in %prep to remove the dependency on
the bundled module. This will prevent an unnecessary dependency on the system
version of the module and eliminate this error.
error: Bad exit status from /var/tmp/rpm-tmp.nn3mkP (%install)
```
The reported error is misleading - the path does not exist yet, but it also can't be created.
os.symlink throws OSError in both cases.
The patch prevents the issue by calling os.makedirs on the group-part of the dependency if there is one.
I have a package that's as follows:
# tree /usr/lib/node_modules/history
/usr/lib/node_modules/history
|-- DOMUtils.js
|-- LocationUtils.js
|-- PathUtils.js
|-- createBrowserHistory.js
|-- createHashHistory.js
|-- createMemoryHistory.js
|-- createTransitionManager.js
|-- es
| |-- DOMUtils.js
| |-- LocationUtils.js
| |-- PathUtils.js
| |-- createBrowserHistory.js
| |-- createHashHistory.js
| |-- createMemoryHistory.js
| |-- createTransitionManager.js
| `-- index.js
|-- index.js
|-- node_modules
| |-- invariant -> /usr/lib/node_modules/invariant
| |-- loose-envify -> /usr/lib/node_modules/loose-envify
| |-- resolve-pathname -> /usr/lib/node_modules/resolve-pathname
| |-- value-equal -> /usr/lib/node_modules/value-equal
| `-- warning -> /usr/lib/node_modules/warning
|-- package.json
`-- umd
|-- history.js
`-- history.min.js
The node_modules directory was created by the %nodejs_symlink_deps
macro. Then when using nodejs.req I don't get any dependencies:
# echo /usr/lib/node_modules/history/package.json | /usr/lib/rpm/nodejs.req
It looks like has_only_bundled_dependencies returns true, while it
shouldn't. Critically, it runs this code:
bundled_dependency_iter = (
os.path.realpath(path)
for path in dependency_path_iter
if not os.path.islink(path) or path.startswith(module_root_path)
)
Here dependency_path_iter is:
[
'/usr/lib/node_modules/history/node_modules/invariant',
'/usr/lib/node_modules/history/node_modules/loose-envify',
'/usr/lib/node_modules/history/node_modules/resolve-pathname',
'/usr/lib/node_modules/history/node_modules/value-equal',
'/usr/lib/node_modules/history/node_modules/warning'
]
And module_root_path is /usr/lib/node_modules/history.
We can conclude that path.startswith(module_root_path) will always be
true, because we started with iterating over files under
module_root_path. The code suggests it should have looked up the real
path instead. If we make that change, it correctly generates the
dependencies.
The generator assumed there is only one /usr/bin/node available in the distro.
Additionally, there were no generators presents for the alternative streams.
This removes the generator from here; a variant of it is being added
to each of the existing nodejs streams, adjusted to work with that
stream specifically.
Resolves: rhbz#2389160
It is out of date as of
https://www.fedoraproject.org/wiki/Changes/NodejsRepackaging and we now
have packaging instructions included in the README.md of the individual
Node.js interpreter packaging repositories.
Signed-off-by: Stephen Gallagher <sgallagh@redhat.com>
The previous behaviour assumed that in a bundled package path,
there is always `node_modules` directory on each other spot – i.e.:
npm/node_modules/<dep1>/node_modules/<subdep>
^ ^
With namespaced bundled packages, this is no longer necessary the truth:
npm/node_modules/@nmcli/<dep1>/node_modules/…
^ ! – expected node_modules
---
The previous implementation considered any directory not named
`node_modules` as a package directory, and tried to process it as such.
Among other things, it pruned the list of subdirectories to be processed
to just another `node_modules` subdir, if that existed.
With namespaced packages, this pruning in essence happened too soon,
and so they were skipped altogether.
With this patch applied, only directories that directly contain
the `package.json` file are processed as package directories,
meaning that the walk should correctly descend into namespaces
(even nested ones, if they appear).
Resolves: rhbz#2029904
bundler: Handle archaic license metadata
bundler: Warn about bundled dependencies with no license metadata
Signed-off-by: Stephen Gallagher <sgallagh@redhat.com>
Adds support for archaic forms of the license metadata in
package.json where the license field is an object rather than a
string.
Also removes the need to post-process the 'null' entries.
Resolves: rhbz#1920206
Signed-off-by: Stephen Gallagher <sgallagh@redhat.com>
Add nodejs-packaging-bundler subpackage in spec file
Update README.md with comments about nodejs-packaging-bundler
and an example spec file that uses bundling
Signed-off-by: Troy Dawson <tdawson@redhat.com>
Since the scripts and tools in this package are really Fedora
(and derivatives) specific, it doesn't really make a lot of
sense to maintain them in a separate upstream with tarball
releases.
This moves all the files into dist-git and builds the RPM from
there.
Signed-off-by: Stephen Gallagher <sgallagh@redhat.com>
