Arch Linux User Repository

Please remove --user root to avoid installing the root npm module

@caleb the .SRCINFO has a package release of 5, but the PKGBUILD is set to 4. This results in an endless installation loop - please bump the PKGBUILD to match. Thanks!

@GFdevelop Thanks for the pointer to npm docs. I only adopted this to bump the version originally and was unaware of the npm issues (as it's not my usual stomping ground). I think I've fixed everything you mentioned.

Edit: Also fixed similar issues is a few other things I have in the AUR, so thanks again for better packages all round.

In the arch wiki there are only 3 rules for npm packages and this package don't respect one of them:

• 777 permissions and non root owner
• temporary cache littering my home
• the package contains reference to $srcdir/$pkgdir

Please read here: https://wiki.archlinux.org/index.php/Node.js_package_guidelines

The fix is:

package() {
    npm install -g --user root --prefix "$pkgdir/usr" "$srcdir/${source[@]##*/}"

    # Non-deterministic race in npm gives 777 permissions to random directories.
    # See <https://github.com/npm/npm/issues/9359> for details.
    find "${pkgdir}/usr" -type d -exec chmod 755 {} +

    # npm gives ownership of ALL FILES to build user
    # <https://bugs.archlinux.org/task/63396>
    chown -R root:root "$pkgdir"

    find "$pkgdir" -name package.json -print0 | xargs -r -0 sed -i '/_where/d'

    local tmppackage="$(mktemp)"
    local pkgjson="$pkgdir/usr/lib/node_modules/$_npmname/package.json"
    jq '.|=with_entries(select(.key|test("_.+")|not))' "$pkgjson" > "$tmppackage"
    mv "$tmppackage" "$pkgjson"
    chmod 644 "$pkgjson"
}

You should probably follow the Node.js Package Guidelines (https://wiki.archlinux.org/index.php/Node.js_package_guidelines) and include the fix for the race condition to avoid issues like the one DeemoDing mentioned.

[2018-12-28 17:24] [ALPM] warning: directory permissions differ on /usr/bin/ filesystem: 755 package: 777 [2018-12-28 17:24] [ALPM] warning: directory permissions differ on /usr/lib/node_modules/jshint/ filesystem: 755 package: 777 [2018-12-28 17:24] [ALPM] warning: directory permissions differ on /usr/lib/node_modules/jshint/data/ filesystem: 755 package: 777 [2018-12-28 17:24] [ALPM] warning: directory permissions differ on /usr/lib/node_modules/jshint/dist/ filesystem: 755 package: 777 [2018-12-28 17:24] [ALPM] warning: directory permissions differ on /usr/lib/node_modules/jshint/node_modules/concat-map/example/ filesystem: 755 package: 777 [2018-12-28 17:24] [ALPM] warning: directory permissions differ on /usr/lib/node_modules/jshint/node_modules/concat-map/test/ filesystem: 755 package: 777 [2018-12-28 17:24] [ALPM] warning: directory permissions differ on /usr/lib/node_modules/jshint/node_modules/core-util-is/ filesystem: 755 package: 777 [2018-12-28 17:24] [ALPM] warning: directory permissions differ on /usr/lib/node_modules/jshint/node_modules/date-now/ filesystem: 755 package: 777 ...............

I think you know what happens

@sum01 Done.

Can npm be made a makedepends instead of depends?

https:// in the source will work; could you switch to it? I can submit a patch, but it is probably easier if you just do it yourself.

Hi, it looks like this needs to depend on npm now as well:

Notice: npm is not shipped with nodejs since 0.12.2-4, please install npm manually if you need it.
Optional dependencies for nodejs
npm: nodejs package manager
/startdir/PKGBUILD: line 22: npm: command not found