From bbd74d8e40a12abad3ee4b46ad4ba0a52df4debf Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 24 Jul 2025 22:53:57 +0000 Subject: [PATCH 01/12] Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild From 64a93f15aacb23ad22dfc8496eb7fe91b95c21db Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jan=20Stan=C4=9Bk?= Date: Wed, 20 Aug 2025 13:53:21 +0200 Subject: [PATCH 02/12] Move nodejs_abi generator to the various streams The generator assumed there is only one /usr/bin/node available in the distro. Additionally, there were no generators presents for the alternative streams. This removes the generator from here; a variant of it is being added to each of the existing nodejs streams, adjusted to work with that stream specifically. Resolves: rhbz#2389160 --- nodejs-packaging.spec | 7 ------- nodejs_abi.attr | 2 -- nodejs_abi.req | 8 -------- 3 files changed, 17 deletions(-) delete mode 100644 nodejs_abi.attr delete mode 100755 nodejs_abi.req diff --git a/nodejs-packaging.spec b/nodejs-packaging.spec index 2553f5b..2a280db 100644 --- a/nodejs-packaging.spec +++ b/nodejs-packaging.spec @@ -19,8 +19,6 @@ Source0007: nodejs-symlink-deps Source0008: nodejs.attr Source0009: nodejs.prov Source0010: nodejs.req -Source0011: nodejs_abi.attr -Source0012: nodejs_abi.req Source0111: nodejs-packaging-bundler @@ -29,9 +27,6 @@ Source0101: test.tar.gz BuildRequires: python3 -# Several of the macros require the /usr/bin/node command, so we need to -# ensure that it is present when packaging. -Requires: /usr/bin/node Requires: redhat-rpm-config %description @@ -63,10 +58,8 @@ tar xvf test.tar.gz %install install -Dpm0644 macros.nodejs %{buildroot}%{macrosdir}/macros.nodejs install -Dpm0644 nodejs.attr %{buildroot}%{_rpmconfigdir}/fileattrs/nodejs.attr -install -Dpm0644 nodejs_abi.attr %{buildroot}%{_rpmconfigdir}/fileattrs/nodejs_abi.attr install -pm0755 nodejs.prov %{buildroot}%{_rpmconfigdir}/nodejs.prov install -pm0755 nodejs.req %{buildroot}%{_rpmconfigdir}/nodejs.req -install -pm0755 nodejs_abi.req %{buildroot}%{_rpmconfigdir}/nodejs_abi.req install -pm0755 nodejs-symlink-deps %{buildroot}%{_rpmconfigdir}/nodejs-symlink-deps install -pm0755 nodejs-fixdep %{buildroot}%{_rpmconfigdir}/nodejs-fixdep install -pm0755 nodejs-setversion %{buildroot}%{_rpmconfigdir}/nodejs-setversion diff --git a/nodejs_abi.attr b/nodejs_abi.attr deleted file mode 100644 index d161239..0000000 --- a/nodejs_abi.attr +++ /dev/null @@ -1,2 +0,0 @@ -%__nodejs_native_requires %{_rpmconfigdir}/nodejs_abi.req -%__nodejs_native_path ^/usr/lib.*/node_modules/.*\\.node$ diff --git a/nodejs_abi.req b/nodejs_abi.req deleted file mode 100755 index a33a7b5..0000000 --- a/nodejs_abi.req +++ /dev/null @@ -1,8 +0,0 @@ -#!/bin/bash - -# Get the ABI version -abi_version=$(/usr/bin/node -p process.versions.modules) - -# Write out the Virtual Requires -echo "nodejs(abi) = ${abi_version}" - From 36224631ac041f4df2a04745bf3b4ec98b84609b Mon Sep 17 00:00:00 2001 From: Ewoud Kohl van Wijngaarden Date: Fri, 27 Jun 2025 13:03:00 +0200 Subject: [PATCH 03/12] Correctly determine if a package has bundled dependencies I have a package that's as follows: # tree /usr/lib/node_modules/history /usr/lib/node_modules/history |-- DOMUtils.js |-- LocationUtils.js |-- PathUtils.js |-- createBrowserHistory.js |-- createHashHistory.js |-- createMemoryHistory.js |-- createTransitionManager.js |-- es | |-- DOMUtils.js | |-- LocationUtils.js | |-- PathUtils.js | |-- createBrowserHistory.js | |-- createHashHistory.js | |-- createMemoryHistory.js | |-- createTransitionManager.js | `-- index.js |-- index.js |-- node_modules | |-- invariant -> /usr/lib/node_modules/invariant | |-- loose-envify -> /usr/lib/node_modules/loose-envify | |-- resolve-pathname -> /usr/lib/node_modules/resolve-pathname | |-- value-equal -> /usr/lib/node_modules/value-equal | `-- warning -> /usr/lib/node_modules/warning |-- package.json `-- umd |-- history.js `-- history.min.js The node_modules directory was created by the %nodejs_symlink_deps macro. Then when using nodejs.req I don't get any dependencies: # echo /usr/lib/node_modules/history/package.json | /usr/lib/rpm/nodejs.req It looks like has_only_bundled_dependencies returns true, while it shouldn't. Critically, it runs this code: bundled_dependency_iter = ( os.path.realpath(path) for path in dependency_path_iter if not os.path.islink(path) or path.startswith(module_root_path) ) Here dependency_path_iter is: [ '/usr/lib/node_modules/history/node_modules/invariant', '/usr/lib/node_modules/history/node_modules/loose-envify', '/usr/lib/node_modules/history/node_modules/resolve-pathname', '/usr/lib/node_modules/history/node_modules/value-equal', '/usr/lib/node_modules/history/node_modules/warning' ] And module_root_path is /usr/lib/node_modules/history. We can conclude that path.startswith(module_root_path) will always be true, because we started with iterating over files under module_root_path. The code suggests it should have looked up the real path instead. If we make that change, it correctly generates the dependencies. --- nodejs.req | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/nodejs.req b/nodejs.req index 129606b..c89a3f7 100755 --- a/nodejs.req +++ b/nodejs.req @@ -633,9 +633,9 @@ def has_only_bundled_dependencies(module_dir_path): for basename in os.listdir(dependency_root_path) ) bundled_dependency_iter = ( - os.path.realpath(path) + path for path in dependency_path_iter - if not os.path.islink(path) or path.startswith(module_root_path) + if not os.path.islink(path) or os.path.realpath(path).startswith(module_root_path) ) return any(bundled_dependency_iter) From cd097f083d7c185e1f138752169464926eeab2b2 Mon Sep 17 00:00:00 2001 From: Evgeni Golov Date: Mon, 1 Sep 2025 08:24:15 +0000 Subject: [PATCH 04/12] Properly handle @group/package deps in nodejs-symlink-deps Node packages can have dependencies of the for "@group/package" instead of just "package". Calling symlink() (and thus os.symlink()) in such a case fails when there is no "@group" directory yet. ``` + /usr/lib/rpm/nodejs-symlink-deps /usr/lib/node_modules ERROR: the path for dependency "@babel/runtime" already exists This could mean that bundled modules are being installed. Bundled libraries are forbidden in Fedora. For more information, see: It is generally reccomended to remove the entire "node_modules" directory in %prep when it exists. For more information, see: If you have obtained permission from the Fedora Packaging Committee to bundle libraries, please use `%nodejs_fixdep -r` in %prep to remove the dependency on the bundled module. This will prevent an unnecessary dependency on the system version of the module and eliminate this error. error: Bad exit status from /var/tmp/rpm-tmp.nn3mkP (%install) ``` The reported error is misleading - the path does not exist yet, but it also can't be created. os.symlink throws OSError in both cases. The patch prevents the issue by calling os.makedirs on the group-part of the dependency if there is one. --- nodejs-symlink-deps | 2 ++ 1 file changed, 2 insertions(+) diff --git a/nodejs-symlink-deps b/nodejs-symlink-deps index b5e44b3..ba525eb 100755 --- a/nodejs-symlink-deps +++ b/nodejs-symlink-deps @@ -30,6 +30,8 @@ import shutil import sys def symlink(source, dest): + if os.path.sep in dest: + os.makedirs(os.path.dirname(dest), exist_ok=True) try: os.symlink(source, dest) except OSError: From 4e33741bc94513a7717e1c3f0e9c0c91dca0c82b Mon Sep 17 00:00:00 2001 From: tjuhasz Date: Thu, 23 Oct 2025 12:58:35 +0200 Subject: [PATCH 05/12] Change %{nodejs_sitelib} to nonversion/shared path (rhbz#2404685) --- macros.nodejs | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/macros.nodejs b/macros.nodejs index 94eae4b..4f14187 100644 --- a/macros.nodejs +++ b/macros.nodejs @@ -1,12 +1,8 @@ # nodejs binary %__nodejs %{_bindir}/node -# currently installed nodejs version -%nodejs_version %(%{__nodejs} -v | sed s/v//) -%_nodejs_major_version %(echo %{nodejs_version} | sed 's#^\\([0-9]\\+\\).*#\\1#') - # nodejs library directory -%nodejs_sitelib %{_prefix}/lib/node_modules_%{_nodejs_major_version} +%nodejs_sitelib %{_prefix}/lib/node_modules #arch specific library directory #for future-proofing only; we don't do multilib From aac86e36466f852be584d553027f907adfb0ec4f Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 16 Jan 2026 22:12:26 +0000 Subject: [PATCH 06/12] Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild From fdd68fbe2d0d49be7b3e7ef82f5449bf0665131e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Thu, 5 Sep 2024 15:49:43 +0100 Subject: [PATCH 07/12] Fix indentation mistakes in nodejs-packaging-bundler MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Daniel P. Berrangé --- nodejs-packaging-bundler | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/nodejs-packaging-bundler b/nodejs-packaging-bundler index 943368a..6c4d368 100755 --- a/nodejs-packaging-bundler +++ b/nodejs-packaging-bundler @@ -70,10 +70,10 @@ for packagejson in $(find . -type d -name node_modules\* -prune -o -type f -name npm install --omit=dev --omit=optional if [ $? -ge 1 ] ; then echo " ERROR WILL ROBINSON" - rm -rf node_modules + rm -rf node_modules else echo " Successful prod dependencies download" - mv node_modules/ node_modules_prod + mv node_modules/ node_modules_prod fi popd done @@ -102,7 +102,7 @@ for packagejson in $(find . -type d -name node_modules\* -prune -o -type f -name echo " ERROR WILL ROBINSON" else echo " Successful dev dependencies download" - mv node_modules/ node_modules_dev + mv node_modules/ node_modules_dev fi popd done From 0a0c95bab746e3c90611f72c5799d73e1feef6cc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Thu, 5 Sep 2024 11:56:49 +0100 Subject: [PATCH 08/12] Use --sort=name when creating tarballs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Using --sort=name ensures that files are added to the tarball in a predictable ordering. This should result in a consistent checksum for the tarball and thus facilitate reproducibility for auditing purposes. Signed-off-by: Daniel P. Berrangé --- nodejs-packaging-bundler | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/nodejs-packaging-bundler b/nodejs-packaging-bundler index 6c4d368..7044e69 100755 --- a/nodejs-packaging-bundler +++ b/nodejs-packaging-bundler @@ -107,10 +107,10 @@ for packagejson in $(find . -type d -name node_modules\* -prune -o -type f -name popd done if [ -d node_modules_prod ] ; then - tar cfz ../${PACKAGE_SAFE}-${VERSION}-nm-prod.tgz $(find . -type d -name node_modules_prod) + tar cfz ../${PACKAGE_SAFE}-${VERSION}-nm-prod.tgz --sort=name $(find . -type d -name node_modules_prod) fi if [ -d node_modules_dev ] ; then - tar cfz ../${PACKAGE_SAFE}-${VERSION}-nm-dev.tgz $(find . -type d -name node_modules_dev) + tar cfz ../${PACKAGE_SAFE}-${VERSION}-nm-dev.tgz --sort=name $(find . -type d -name node_modules_dev) fi cd .. cp -v ${PACKAGE_SAFE}-${VERSION}* "${OUTPUT_DIR}" From b786cecdf9c56069a122b09eeba373fa74e3a8fa Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Wed, 4 Sep 2024 18:59:03 +0100 Subject: [PATCH 09/12] Honour package version when no tarball is given MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Daniel P. Berrangé --- nodejs-packaging-bundler | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nodejs-packaging-bundler b/nodejs-packaging-bundler index 7044e69..47486a4 100755 --- a/nodejs-packaging-bundler +++ b/nodejs-packaging-bundler @@ -60,7 +60,7 @@ if [ -f "$TARBALL" ]; then mv ${TARBALL_DIR}/*.tgz . rm -rf ${TARBALL_DIR} else - npm pack ${PACKAGE} + npm pack ${PACKAGE}@${VERSION} fi tar xfz *.tgz cd package From 8c93ed16060c9a3ce9feea73555a7ede76ceacca Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Tue, 3 Feb 2026 16:43:30 +0000 Subject: [PATCH 10/12] Always report the nodejs engine dep MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The "has only bundled deps" check was short-circuiting logic too early, causing the "nodejs(engine) == " dep to be missed, which is still relevant even when bundling. Signed-off-by: Daniel P. Berrangé --- nodejs.req | 6 +++--- test/bundled/nodejs.req.out.exp | 2 +- test/bundled_namespace/nodejs.req.out.exp | 2 +- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/nodejs.req b/nodejs.req index c89a3f7..47e94aa 100755 --- a/nodejs.req +++ b/nodejs.req @@ -659,9 +659,6 @@ def extract_dependencies(metadata_path, optional=False): TypeError: Invalid dependency data type. """ - if has_only_bundled_dependencies(os.path.dirname(metadata_path)): - return # skip - # Read metadata try: with open(metadata_path, mode="r") as metadata_file: @@ -676,6 +673,9 @@ def extract_dependencies(metadata_path, optional=False): except KeyError: # NodeJS engine version unspecified yield rpm_format("nodejs(engine)") + if has_only_bundled_dependencies(os.path.dirname(metadata_path)): + return # skip + # Report listed dependencies kind = "optionalDependencies" if optional else "dependencies" container = metadata.get(kind, {}) diff --git a/test/bundled/nodejs.req.out.exp b/test/bundled/nodejs.req.out.exp index 8b13789..64d8bb4 100644 --- a/test/bundled/nodejs.req.out.exp +++ b/test/bundled/nodejs.req.out.exp @@ -1 +1 @@ - +(nodejs(engine) >= 6 with nodejs(engine) < 10) diff --git a/test/bundled_namespace/nodejs.req.out.exp b/test/bundled_namespace/nodejs.req.out.exp index 8b13789..64d8bb4 100644 --- a/test/bundled_namespace/nodejs.req.out.exp +++ b/test/bundled_namespace/nodejs.req.out.exp @@ -1 +1 @@ - +(nodejs(engine) >= 6 with nodejs(engine) < 10) From d5492bc3059008b8b05e3221ee0fd2e16345ff95 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jan=20Stan=C4=9Bk?= Date: Wed, 4 Feb 2026 14:42:48 +0100 Subject: [PATCH 11/12] Update tests from git --- sources | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sources b/sources index 52e9e27..a7170f1 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (test.tar.gz) = dfbda67b8741f1ca36bf63b2e842f81ba07381b3d92e75fa7e29f8e456543b4cae55e95785902f31a14ae4d0b7e89161ba04c0c10c2fff617b4ae9607c91e599 +SHA512 (test.tar.gz) = 04c1e741caa124c12b1070b6411d1a9fef9b328e15ec274170b7dcd9d26d9a6f9db21d6722ce0b39d0b693f237398065dd127b95a9a6e4947e182db2e3fad6f2 From 769c465c78027de1ebda66f070d37a5b0e857f8a Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 16 Jul 2026 09:39:21 +0000 Subject: [PATCH 12/12] Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild