Remove references of srcdir/pkgdir from package.json

Fix ownership of files given to build user

2 files changed, 27 insertions, 11 deletions

diff --git a/.SRCINFO b/.SRCINFO
index 7469280b5a66..0fce3605549f 100644
--- a/.SRCINFO
+++ b/.SRCINFO
@@ -1,7 +1,7 @@
 pkgbase = nodejs-serverless
 	pkgdesc = Serverless Framework - Build web, mobile and IoT applications with serverless architectures using AWS Lambda, Azure Functions, Google CloudFunctions & more
 	pkgver = 3.16.0
-	pkgrel = 1
+	pkgrel = 2
 	url = https://serverless.com/framework/docs/
 	arch = any
 	license = MIT
diff --git a/PKGBUILD b/PKGBUILD
index 390269584a7d..c864c1cd35cf 100644
--- a/PKGBUILD
+++ b/PKGBUILD
@@ -1,24 +1,40 @@
 # Maintainer: bacteriostat <dev.bacteriostat at aleeas dot com>
 # Contributor: Hugues Chabot <at google mail>
 _npmname=serverless
-_npmver=3.16.0
-pkgname=nodejs-serverless # All lowercase
+pkgname=nodejs-$_npmname # All lowercase
 pkgver=3.16.0
-pkgrel=1
+pkgrel=2
 pkgdesc="Serverless Framework - Build web, mobile and IoT applications with serverless architectures using AWS Lambda, Azure Functions, Google CloudFunctions & more"
 arch=(any)
 url="https://serverless.com/framework/docs/"
 license=(MIT)
 depends=('nodejs' 'npm')
 optdepends=()
-source=(https://registry.npmjs.org/$_npmname/-/$_npmname-$_npmver.tgz)
-noextract=($_npmname-$_npmver.tgz)
+source=(https://registry.npmjs.org/$_npmname/-/$_npmname-$pkgver.tgz)
+noextract=($_npmname-$pkgver.tgz)
 sha1sums=('d721f6f12ba12661e50974c7895d6dab35efdf90')
 
 package() {
-  cd $srcdir
-  local _npmdir="$pkgdir/usr/lib/node_modules/"
-  mkdir -p $_npmdir
-  cd $_npmdir
-  npm install -g --prefix "$pkgdir/usr" --ignore-scripts $_npmname@$_npmver
+  npm install \
+  	--global \
+  	--prefix "$pkgdir/usr" \
+  	--cache "$srcdir/npm-cache" \
+  	--ignore-scripts \
+  	"$srcdir"/$_npmname-$pkgver.tgz
+
+  # Non-deterministic race in npm gives 777 permissions to random directories.
+  # See https://github.com/npm/npm/issues/9359 for details.
+  # find "${pkgdir}"/usr -type d -exec chmod 755 {} +
+
+  # npm gives ownership of ALL FILES to build user
+  # https://bugs.archlinux.org/task/63396
+  chown -R root:root "$pkgdir"
+
+  # Remove local paths from package.json
+  find "$pkgdir" -name package.json -print0 | xargs -r -0 sed -i '/_where/d'
+  local tmppackage="$(mktemp)"
+  local pkgjson="$pkgdir/usr/lib/node_modules/$_npmname/package.json"
+  jq '.|=with_entries(select(.key|test("_.+")|not))' "$pkgjson" > "$tmppackage"
+  mv "$tmppackage" "$pkgjson"
+  chmod 644 "$pkgjson"
 }