feature: Avoid bundling native binaries - #93
Conversation
d7b5e10 to
5701305
Compare
|
Hi! I'm a Fedora packager. I recently noticed that Fedora's process for packaging Node.js software is flawed, and that it results in pre-compiled content being bundled and potentially shipped to users. I've been investigating alternate approaches, and npm2rpm looks like an excellent place to start! npm2rpm doesn't yet have a feature to detect and remove native binaries and Wasm from the bundled content, which Fedora would need, so I've added it. With that addition, I think that this could replace several Fedora tools and simplify the standard process. I'll be discussing adoption of npm2rpm with the Fedora Node.js SIG next. |
|
Let's allow CI to run on this 😬. |
5701305 to
2fca4ad
Compare
|
I've added a couple of changes. First, probably a superficial change: As a convention, source0 is normally the primary archive in a spec in Fedora. Second: In order to support removing binaries from that archive and to support applying patches to the primary archive (which must be supported for Fedora to use this), I've added a section that extracts and then repacks the primary archive. The npm install command then refers to the re-packed archive instead of the module name@version. |
|
After #100 this needs to be rethought. |
Make the main package Source0 instead of appearing alphabetically in the source list with dependencies. This makes it easier to apply patches to the main package in %prep since Source0 is the conventional location for the primary source archive. Filter the main package from the deps array before numbering dependency sources to avoid duplication, since npm-remote-ls returns the main package along with its flattened dependency tree. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com> Signed-off-by: Gordon Messmer <gmessmer@redhat.com>
After adding all sources to the npm cache, extract Source0 into a temporary directory where patches can be applied or binaries removed. Repack the modified content as a tarball in the build directory. In %build, install from the repacked tarball path instead of by name@version. This allows npm to use the patched content while still resolving dependencies from the cache. This approach avoids integrity hash conflicts since npm uses the tarball we provide directly rather than looking it up in the cache. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com> Signed-off-by: Gordon Messmer <gmessmer@redhat.com>
2fca4ad to
52c7c6e
Compare
Fedora packaging guidelines do not permit distributing pre-built native binaries. If the primary source includes such files, they should be deleted in the %prep stage. If dependencies include such files, the module should be packaged on its own and not bundled. This change introduces a command line option intended for use on Fedora packages. Signed-off-by: Gordon Messmer <gmessmer@redhat.com> Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
52c7c6e to
cbf8154
Compare
|
I've rebased on the new release and adapted to the changes. |
3 participants
Fedora packaging guidelines do not permit distributing pre-built
native binaries. If the primary source includes such files, they
should be deleted in the %prep stage. If dependencies include such
files, the module should be packaged on its own and not bundled.
This change introduces a command line option intended for use on
Fedora packages.