use Arch Wiki permission fixes

https://wiki.archlinux.org/title/Node.js_package_guidelines#Using_npm

1 files changed, 13 insertions, 8 deletions

diff --git a/PKGBUILD b/PKGBUILD
index 702a6c7ddb3e..f0611d302c4d 100644
--- a/PKGBUILD
+++ b/PKGBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Mike Yuan <me@yhndnzj.com>
 
 pkgname=nodejs-hexo-cli
-_srcname=${pkgname#nodejs-}
+_pkgname=${pkgname#nodejs-}
 pkgver=4.2.0
 pkgrel=2
 pkgdesc="Command line interface for Hexo"
@@ -11,16 +11,21 @@ license=('MIT')
 depends=('nodejs')
 makedepends=('npm')
 conflicts=('nodejs-hexo')
-source=(https://registry.npmjs.org/$_srcname/-/$_srcname-$pkgver.tgz)
-noextract=($_srcname-$pkgver.tgz)
+source=(https://registry.npmjs.org/$_pkgname/-/$_pkgname-$pkgver.tgz)
+noextract=($_pkgname-$pkgver.tgz)
 sha256sums=('f169b782712f88eb4ebfc7498a359a0535852c2166e7f58193b85caee8f992e9')
 
 package() {
-  npm install -g --prefix "$pkgdir"/usr "$srcdir"/$_srcname-$pkgver.tgz
+  npm install -g --prefix "$pkgdir/usr" "$srcdir/$_pkgname-$pkgver.tgz"
 
-  chmod -R u=rwX,go=rX "$pkgdir"
-  chown -R root:root "$pkgdir"
+  # Non-deterministic race in npm gives 777 permissions to random directories.
+  # See https://github.com/npm/cli/issues/1103 for details.
+  find "${pkgdir}/usr" -type d -exec chmod 755 {} +
 
-  install -d "$pkgdir"/usr/share/licenses/$pkgname
-  ln -s ../../../lib/node_modules/$_srcname/LICENSE "$pkgdir"/usr/share/licenses/$pkgname/LICENSE
+  # npm gives ownership of ALL FILES to build user
+  # https://bugs.archlinux.org/task/63396
+  chown --recursive root:root "${pkgdir}"
+
+  install --directory "$pkgdir"/usr/share/licenses/$pkgname
+  ln --symbolic ../../../lib/node_modules/$_pkgname/LICENSE "$pkgdir"/usr/share/licenses/$pkgname/LICENSE
 }