Problem
Every template variant executes dependency preinstall/install/postinstall in the buildroot — master's npm install --offline, #97's, and #100's npm ci --offline alike. There are zero --ignore-scripts occurrences across npm2rpm (master, both PR branches) and foreman-packaging rpm/develop. Buildroot network isolation does not prevent a malicious postinstall from modifying files that then get packaged into the RPM.
Raised by @ekohl in #100 (comment).
Measured exposure
Across the generated lockfiles for all 43 bundle-strategy packages — 1,118 installed entries — exactly one package has an install script:
jq -r '.packages | with_entries(select(.value.hasInstallScript)) | keys[]' *-package-lock.json
core-js@2.6.12, in nodejs-patternfly-react, nodejs-patternfly-react-extensions, nodejs-react-bootstrap and nodejs-react-json-tree. Its script is the donation banner, already wrapped in a swallowing try/catch:
"postinstall": "node -e \"try{require('./postinstall')}catch(e){}\""gypfile: false, and since hasInstallScript is also what npm sets for implicit node-gyp builds, the enumeration is complete for what npm ci would execute — there are no native builds anywhere in the set, consistent with everything being BuildArch: noarch.
Proposed fix
Add --ignore-scripts to the template's install invocation. It also pins the behaviour explicitly across npm 12's default change, so a buildroot npm upgrade cannot silently alter build semantics in either direction.
Validation plan
Targeted first: rebuild the four core-js-containing packages on rhel-9/rhel-10/fedora-eln with the flag and diff the repodata filelists — those are the only packages whose contents can change. Then the full 43-package Copr matrix and filelist diff as belt-and-braces.
For the record, unrelated to this change: git dependencies can execute code during preparation outside the script gates on npm ≤ 12. Not applicable here — all 1,302 Sources across rpm/develop's nodejs packages are registry tarballs (0 non-registry), and npm 12 defaults to --allow-git=none, which is why registry-only Sources are the project's actual boundary.
Problem
Every template variant executes dependency
preinstall/install/postinstallin the buildroot — master'snpm install --offline, #97's, and #100'snpm ci --offlinealike. There are zero--ignore-scriptsoccurrences across npm2rpm (master, both PR branches) and foreman-packagingrpm/develop. Buildroot network isolation does not prevent a maliciouspostinstallfrom modifying files that then get packaged into the RPM.Raised by @ekohl in #100 (comment).
Measured exposure
Across the generated lockfiles for all 43 bundle-strategy packages — 1,118 installed entries — exactly one package has an install script:
core-js@2.6.12, innodejs-patternfly-react,nodejs-patternfly-react-extensions,nodejs-react-bootstrapandnodejs-react-json-tree. Its script is the donation banner, already wrapped in a swallowing try/catch:gypfile: false, and sincehasInstallScriptis also what npm sets for implicitnode-gypbuilds, the enumeration is complete for whatnpm ciwould execute — there are no native builds anywhere in the set, consistent with everything beingBuildArch: noarch.Proposed fix
Add
--ignore-scriptsto the template's install invocation. It also pins the behaviour explicitly across npm 12's default change, so a buildroot npm upgrade cannot silently alter build semantics in either direction.Validation plan
Targeted first: rebuild the four core-js-containing packages on rhel-9/rhel-10/fedora-eln with the flag and diff the repodata filelists — those are the only packages whose contents can change. Then the full 43-package Copr matrix and filelist diff as belt-and-braces.
For the record, unrelated to this change: git dependencies can execute code during preparation outside the script gates on npm ≤ 12. Not applicable here — all 1,302 Sources across
rpm/develop's nodejs packages are registry tarballs (0 non-registry), and npm 12 defaults to--allow-git=none, which is why registry-only Sources are the project's actual boundary.