Note: This is a beta release of Red Hat Bugzilla 5.0. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Also email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback here.
Bug 1518262 - Review Request: nodejs-yarn - Fast, reliable, and secure dependency management
Summary: Review Request: nodejs-yarn - Fast, reliable, and secure dependency management
Keywords:
Status: CLOSED RAWHIDE
Alias: None
Product: Fedora
Classification: Fedora
Component: Package Review
Version: rawhide
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Neal Gompa
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks: nodejs-reviews
TreeView+ depends on / blocked
 
Reported: 2017-11-28 14:06 UTC by Zuzana Svetlikova
Modified: 2018-07-06 11:16 UTC (History)
5 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2018-07-06 11:16:22 UTC
ngompa13: fedora-review+


Attachments (Terms of Use)

Description Zuzana Svetlikova 2017-11-28 14:06:17 UTC
Spec URL: https://zvetlik.fedorapeople.org/nodejs-yarn/nodejs-yarn.spec
SRPM URL: https://zvetlik.fedorapeople.org/nodejs-yarn/nodejs-yarn-1.3.2-1.fc28.src.rpm
Description: Fast, reliable, and secure dependency management
Fedora Account System Username: zvetlik

Comment 1 Neal Gompa 2017-11-28 14:33:45 UTC
Taking this review.

Comment 2 Zuzana Svetlikova 2017-12-04 12:09:35 UTC
Any update?

Comment 3 Neal Gompa 2017-12-04 15:09:49 UTC
># packaging from npm is far more easier than packaging from GH
> Source0:	https://registry.npmjs.org/%{npm_name}/-/%{npm_name}-%{version}.tgz

Upstream does not advise that yarn sources are retrieved from npm and suggest it should be packaged from the pristine sources uploaded to GitHub.

Have you verified that the sources are the same and that it is functional?

>License:	BSD-2-Clause

We do not use SPDX identifiers in Fedora. This should be "BSD".

> %files
> ...
> %{_bindir}/nodejs-yarn
> %{_bindir}/nodejs-yarnpkg

No one is going to be able to find either of these. Also, I don't know of any conflicts that exist for "%{_bindir}/yarnpkg". As for "%{_bindir}/nodejs-yarn", how are you going to make this discoverable?

If you're renaming files, you also need to provide a README.Fedora that is installed into the yarn doc dir that describes our changes.

Comment 4 Zuzana Svetlikova 2017-12-06 16:08:38 UTC
> Upstream does not advise that yarn sources are retrieved from npm and suggest it should be packaged from the pristine sources uploaded to GitHub.

I haven't seen such information. But I admit, that among alternative install methods[1] they state "installing from npm is not recommended due to security risks" and rather provide their own tarball, which is, however, the same, contentwise. I will change URL to that source [2].

When I tried GH sources, I needed to install quite an amount of packages. To be exact:
root@435574b62c7d:~/yarn# npm ls | wc -l
1725
I would like to avoid that.

> Also, I don't know of any conflicts that exist for "%{_bindir}/yarnpkg".

I wanted some consistency, so I renamed both yarn and yarnpkg.
Readme added.

[1]: https://yarnpkg.com/en/docs/install#alternatives-tab
[2]: https://yarnpkg.com/downloads/1.3.2/yarn-v1.3.2.tar.gz

Spec URL: https://zvetlik.fedorapeople.org/nodejs-yarn/nodejs-yarn.spec
SRPM URL: https://zvetlik.fedorapeople.org/nodejs-yarn/nodejs-yarn-1.3.2-2.fc28.src.rpm

Comment 5 Neal Gompa 2017-12-06 17:15:01 UTC
(In reply to Zuzana Svetlikova from comment #4)
> > Upstream does not advise that yarn sources are retrieved from npm and suggest it should be packaged from the pristine sources uploaded to GitHub.
> 
> I haven't seen such information. But I admit, that among alternative install
> methods[1] they state "installing from npm is not recommended due to
> security risks" and rather provide their own tarball, which is, however, the
> same, contentwise. I will change URL to that source [2].
> 
> When I tried GH sources, I needed to install quite an amount of packages. To
> be exact:
> root@435574b62c7d:~/yarn# npm ls | wc -l
> 1725
> I would like to avoid that.

This means that you're bundling all those node modules, right? Then you need to declare bundled() Provides for all the components you're bundling[1].

[1]: https://fedoraproject.org/wiki/Bundled_Libraries#Requirement_if_you_bundle

Comment 6 Zuzana Svetlikova 2017-12-11 12:30:59 UTC
That would be the case if I were building yarn from GH sources. In this case I just install the (already built) tarball.

Comment 7 Tom Hughes 2018-01-15 12:05:33 UTC
That doesn't alter the fact that it is bundling those modules, but not even as proper bundled modules in a node_modules subdirectory - it seems everything has been smashed together in one file.

I'm not sure what the answer is but I don't see how using the prebuilt tar ball here meets the requirement to build from source, even ignoring the bundling issue.

Comment 8 Tom Hughes 2018-01-15 12:07:39 UTC
Also this is installing in /usr/lib/node_modules/nodejs-yarn which should be /usr/lib/node_modules/yarn.

Comment 9 Zuzana Svetlikova 2018-01-30 16:32:17 UTC
So I tried packaging from GH and avoiding webpack, so all the node modules don't end up squashed in one file.

Spec URL: https://fedorapeople.org/~zvetlik/nodejs-yarn/nodejs-yarn.spec
SRPM URL: https://fedorapeople.org/~zvetlik/nodejs-yarn/nodejs-yarn-1.4.1-1.fc28.src.rpm

Comment 10 Neal Gompa 2018-02-02 16:59:39 UTC
The package looks good, though there is one problem:

* nodejs-yarn is producing Provides + Requires for node modules that are already bundled in the package.

This would cause a lot of erroneous things to happen.

Comment 11 Tom Hughes 2018-02-02 17:02:26 UTC
If the bundling is done properly then the generator auto generate bundled() provides instead of normal ones?

Comment 12 Tom Hughes 2018-02-02 17:05:39 UTC
Build is failing for me anyway because it's still trying to symlink global modules in %check... Might work in mock I guess.

Comment 13 Tom Hughes 2018-02-02 17:08:40 UTC
That does look like something has gone wrong with the dependency generator :-(

Comment 14 Tom Hughes 2018-02-02 17:09:27 UTC
Ah it has generated both sorts of provide and also requires. That is a bug...

Comment 15 Peter Oliver 2018-02-27 18:04:27 UTC
(In reply to Zuzana Svetlikova from comment #4)

> > Also, I don't know of any conflicts that exist for "%{_bindir}/yarnpkg".
> 
> I wanted some consistency, so I renamed both yarn and yarnpkg.

yarnpkg is an alias to yarn.  Presumably, the reason that this alias exists is to provide a consistent name in places where yarn is already taken by something else, as is the case here.

Consequently, I think it would be best to leave yarnpkg at /usr/bin/yarnpkg.  If this were so, I can't see any reason why anyone would want to use Fedora-specific /usr/bin/nodejs-yarn in preference to works-everywhere /usr/bin/yarnpkg, so it would probably be reasonable to leave /usr/bin/nodejs-yarn unpackaged.

Comment 16 Zuzana Svetlikova 2018-03-21 16:38:12 UTC
So, I looked into it.. it generated provides just fine, and for requires it skips the uppermost node_modules directory, but still generates requires for bundled modules. Here I used %__provides_exclude_from macro.
As for the nodejs- prefix, I left nodejs-yarn and removed it from yarnpkg, but maybe someone else could express their opinion on this.

Spec URL: https://fedorapeople.org/~zvetlik/nodejs-yarn/nodejs-yarn.spec
SRPM URL: https://fedorapeople.org/~zvetlik/nodejs-yarn/nodejs-yarn-1.5.1-2.fc28.src.rpm

Comment 17 Neal Gompa 2018-03-21 18:43:25 UTC
The SRPM URL is invalid. Please post a working SRPM link.

Comment 19 Neal Gompa 2018-03-24 18:16:10 UTC
The nodejs-yarn package has "npm()" Provides for all the bundled nodejs modules, which would confuse and break things.

Comment 20 Neal Gompa 2018-03-24 18:17:48 UTC
Also, the spec and SRPM don't match, at least with the changelog, though it looks like it's because you fixed the changelog entries in the spec...

Comment 21 Zuzana Svetlikova 2018-05-09 09:03:17 UTC
Rebuilt with new nodejs-packaging.

Spec URL: https://fedorapeople.org/~zvetlik/nodejs-yarn/nodejs-yarn.spec
SRPM URL: https://fedorapeople.org/~zvetlik/nodejs-yarn/nodejs-yarn-1.6.0-1.fc29.src.rpm

Comment 22 Neal Gompa 2018-05-09 21:53:15 UTC
Review notes:

* Complies with packaging guidelines
* Bundled dependencies are fully enumerated
* Follows packaging policies for Nodejs applications
* No rpmlint errors of note

PACKAGE APPROVED.

Comment 23 Gwyn Ciesla 2018-05-14 13:25:46 UTC
(fedrepo-req-admin):  The Pagure repository was created at https://src.fedoraproject.org/rpms/nodejs-yarn

Comment 24 Neal Gompa 2018-07-06 11:16:22 UTC
Pushed into rawhide.


Note You need to log in before you can comment on or make changes to this bug.