paketo-buildpacks / npm-install Goto Github PK

A Cloud Native Buildpack for npm

License: Apache License 2.0

Go 93.48% Shell 6.52%

npm-install's Introduction

Paketo Buildpack for NPM Install

The NPM Install CNB makes use of the npm tooling installed within the Node Engine CNB to manage application dependencies.

Integration

The NPM Install CNB provides node_modules as a dependency. Downstream buildpacks can require the node_modules dependency by generating a Build Plan TOML file that looks like the following:

[[requires]]

  # The name of the NPM Install dependency is "node_modules". This value is
  # considered part of the public API for the buildpack and will not change
  # without a plan for deprecation.
  name = "node_modules"

  # Note: The version field is unsupported as there is no version for a set of
  # npm.

  # The NPM Install buildpack supports some non-required metadata options.
  [requires.metadata]

    # Setting the build flag to true will ensure that the node modules are
    # available for subsequent buildpacks during their build phase.
    # If you are writing a buildpack that needs to run a node module during its build
    # process, this flag should be set to true.
    build = true

    # Setting the launch flag to true will ensure that the packages managed by
    # NPM will be available for the running application. If you
    # are writing an application that needs to run node modules at runtime, this
    # flag should be set to true.
    launch = true

Usage

To package this buildpack for consumption:

$ ./scripts/package.sh --version <version-number>

This will create a buildpackage.cnb file under the build directory which you can use to build your app as follows: pack build <app-name> -p <path-to-app> -b <path/to/node-engine.cnb> -b build/buildpackage.cnb

Specifying a project path

To specify a project subdirectory to be used as the root of the app, please use the BP_NODE_PROJECT_PATH environment variable at build time either directly (e.g. pack build my-app --env BP_NODE_PROJECT_PATH=./src/my-app) or through a project.toml file. This could be useful if your app is a part of a monorepo.

Run Tests

To run all unit tests, run:

./scripts/unit.sh

To run all integration tests, run:

/scripts/integration.sh

Stack support

For most apps, the NPM Install Buildpack runs fine on the Base builder. But when the app requires compilation of native extensions using node-gyp, the buildpack requires that you use the Full builder. This is because node-gyp requires python that's absent on the Base builder, and the module may require other shared objects.

npm-install's People

Contributors

Stargazers

Watchers

Forkers

kardolus andymoe sap-contributions noamichael foresteckhardt samj1912 g-suraj joshuatcasey devcolor cz4rny trellixvulnteam mhdawson pacostas brayanhenao ninech jericop lazyuki

npm-install's Issues

Implement RFC0044: Disable SBOM

This buildpack should opt-in to allowing users to disable SBOM. In doing so, it should conform to RFC044.

Please configure GITBOT

Pivotal provides the Gitbot service to synchronize issues and pull requests made against public GitHub repos with Pivotal Tracker projects.

If you do not want to use Pivotal Tracker to manage this GitHub repo, you do not need to take any action.

If you are a Pivotal employee, you can configure Gitbot to sync your GitHub repo to your Pivotal Tracker project with a pull request.

Steps:

Add the Toolsmiths-Bots team to have admin access to your repo
Add the cf-gitbot ([email protected]) user to have owner access to your Pivotal Tracker project
Create new branch in this repo: cfgitbot-config (an ask+cf@ ticket is the fastest way to get write access if you get a 404)
Add your new repo and or project to config-production.yml file
Submit a PR, which will get auto-merged if you've done it right. Detailed steps here

If you are not a pivotal employee, you can request that [email protected] set up the integration for you.

You might also be interested in configuring GitHub's Service Hook for Tracker on your repo so you can link your commits to Tracker stories. You can do this yourself by following the directions at:

https://www.pivotaltracker.com/blog/guide-githubs-service-hook-tracker/

If there are any questions, please reach out to [email protected].

Implement BOM

As a result of #218, we have a viable way to implement the BOM on the NPM Install buildpack so that we can collect metadata on all language-specific modules installed by this buildpack.

This issue is to implement this work as it will be outlined in the RFC associated with paketo-buildpacks/nodejs#425.

Acceptance

The outcome of this story should be that a BOM is available from this buildpack that includes metadata about all of the installed modules. The format should conform to paketo-buildpacks/rfcs#57

Blocking

This story is blocked on the creation and acceptance of the RFC in paketo-buildpacks/nodejs#425.

Fix module name and package name

Module name should be module github.com/paketo-buildpacks/npm-install and package npm-install (not npm)

Proposal: Show appropriate error when app with native extensions are built with unsupported builder

Problem: For most apps, npm-install runs fine on the base builder. But when the app requires compilation of native extensions using node-gyp, the buildpack requires the full builder because node-gyp requires python and the module may require other shared objects.

Reproducing the issue

Remove the builder line in integration.json
Run this test
You can see it fails the build step with:

[builder] Paketo NPM Install Buildpack 1.2.3
[builder]   Resolving installation process
[builder]     Process inputs:
[builder]       node_modules      -> "Found"
[builder]       npm-cache         -> "Not found"
[builder]       package-lock.json -> "Found"
[builder] 
[builder]     Selected NPM build process: 'npm rebuild'
[builder] 
[builder]   Executing build process
[builder]     Running 'npm run-script preinstall --if-present'
[builder]     Running 'npm rebuild --nodedir=/layers/paketo-buildpacks_node-engine/node'
[builder]     [email protected] /workspace
[builder]     +-- [email protected]
[builder] npm rebuild failed: exit status 1
[builder]     | +-- [email protected]
[builder]     | +-- [email protected]
[builder]     | | +-- [email protected]
[builder]     | | +-- [email protected]
[builder]     | | +-- [email protected]
[builder]     | | | `-- [email protected]
[builder]     | | +-- [email protected]
[builder]     | | | `-- [email protected] deduped
[builder]     | | `-- [email protected]
[builder]     | +-- [email protected]
[builder]     | | `-- [email protected]
[builder]     | +-- [email protected]
[builder]     | `-- [email protected]
[builder]     |   +-- [email protected]
[builder]     |   | +-- [email protected]
[builder]     |   | `-- [email protected] deduped
[builder]     |   +-- [email protected]
[builder]     |   +-- [email protected]
[builder]     |   | +-- [email protected]
[builder]     |   | | `-- [email protected]
[builder]     |   | `-- [email protected]
[builder]     |   +-- [email protected]
[builder]     |   +-- [email protected]
[builder]     |   +-- [email protected]
[builder]     |   | +-- [email protected]
[builder]     |   | +-- [email protected]
[builder]     |   | | `-- [email protected]
[builder]     |   | +-- [email protected] deduped
[builder]     |   | `-- [email protected]
[builder]     |   |   +-- [email protected]
[builder]     |   |   | +-- [email protected] deduped
[builder]     |   |   | `-- [email protected]
[builder]     |   |   `-- [email protected]
[builder]     |   |     +-- [email protected]
[builder]     |   |     `-- [email protected] deduped
[builder]     |   +-- [email protected]
[builder]     |   +-- [email protected]
[builder]     |   | +-- [email protected]
[builder]     |   | | +-- [email protected]
[builder]     |   | | | `-- [email protected] deduped
[builder]     |   | | `-- [email protected]
[builder]     |   | |   `-- [email protected]
[builder]     |   | `-- [email protected]
[builder]     |   |   +-- [email protected]
[builder]     |   |   | +-- [email protected]
[builder]     |   |   | +-- [email protected]
[builder]     |   |   | | `-- [email protected]
[builder]     |   |   | |   `-- [email protected]
[builder]     |   |   | +-- [email protected]
[builder]     |   |   | +-- [email protected] deduped
[builder]     |   |   | `-- [email protected]
[builder]     |   |   |   `-- [email protected]
[builder]     |   |   +-- [email protected] deduped
[builder]     |   |   `-- [email protected]
[builder]     |   |     +-- [email protected] deduped
[builder]     |   |     +-- [email protected] deduped
[builder]     |   |     `-- [email protected] deduped
[builder]     |   +-- [email protected]
[builder]     |   | +-- [email protected]
[builder]     |   | | `-- [email protected]
[builder]     |   | |   `-- [email protected]
[builder]     |   | `-- [email protected]
[builder]     |   |   `-- [email protected]
[builder]     |   `-- [email protected]
[builder]     +-- [email protected]
[builder]     | +-- [email protected]
[builder]     | +-- [email protected]
[builder]     | | `-- [email protected]
[builder]     | +-- [email protected]
[builder]     | | +-- [email protected]
[builder]     | | | `-- [email protected]
[builder]     | | +-- [email protected]
[builder]     | | | `-- [email protected]
[builder]     | | `-- [email protected]
[builder]     | +-- [email protected]
[builder]     | | +-- [email protected]
[builder]     | | `-- [email protected]
[builder]     | |   +-- [email protected]
[builder]     | |   `-- [email protected]
[builder]     | +-- [email protected]
[builder]     | | +-- [email protected]
[builder]     | | | `-- [email protected]
[builder]     | | |   `-- [email protected]
[builder]     | | |     +-- [email protected]
[builder]     | | |     `-- [email protected]
[builder]     | | `-- [email protected]
[builder]     | |   `-- [email protected]
[builder]     | +-- [email protected]
[builder]     | | +-- [email protected]
[builder]     | | | +-- [email protected]
[builder]     | | | `-- [email protected]
[builder]     | | |   +-- [email protected]
[builder]     | | |   +-- [email protected] deduped
[builder]     | | |   +-- [email protected]
[builder]     | | |   +-- [email protected]
[builder]     | | |   +-- [email protected] deduped
[builder]     | | |   +-- [email protected]
[builder]     | | |   | `-- [email protected] deduped
[builder]     | | |   `-- [email protected]
[builder]     | | +-- [email protected]
[builder]     | | +-- [email protected]
[builder]     | | | +-- [email protected]
[builder]     | | | +-- [email protected] deduped
[builder]     | | | +-- [email protected]
[builder]     | | | +-- [email protected] deduped
[builder]     | | | +-- [email protected] deduped
[builder]     | | | +-- [email protected]
[builder]     | | | | +-- [email protected]
[builder]     | | | | +-- [email protected]
[builder]     | | | | | `-- [email protected]
[builder]     | | | | `-- [email protected] deduped
[builder]     | | | +-- [email protected] deduped
[builder]     | | | `-- [email protected]
[builder]     | | |   `-- [email protected] deduped
[builder]     | | `-- [email protected]
[builder]     | +-- [email protected]
[builder]     | | +-- [email protected]
[builder]     | | +-- [email protected]
[builder]     | | +-- [email protected]
[builder]     | | `-- [email protected]
[builder]     | +-- [email protected]
[builder]     | | `-- [email protected]
[builder]     | |   +-- [email protected]
[builder]     | |   +-- [email protected]
[builder]     | |   | +-- [email protected] deduped
[builder]     | |   | `-- [email protected]
[builder]     | |   +-- [email protected]
[builder]     | |   +-- [email protected] deduped
[builder]     | |   +-- [email protected]
[builder]     | |   | `-- [email protected] deduped
[builder]     | |   `-- [email protected]
[builder]     | +-- [email protected]
[builder]     | `-- [email protected]
[builder]     |   +-- [email protected]
[builder]     |   +-- [email protected]
[builder]     |   | `-- [email protected] deduped
[builder]     |   +-- [email protected]
[builder]     |   | +-- [email protected] deduped
[builder]     |   | `-- [email protected] deduped
[builder]     |   +-- [email protected]
[builder]     |   | `-- [email protected] deduped
[builder]     |   +-- [email protected] deduped
[builder]     |   +-- [email protected]
[builder]     |   `-- [email protected]
[builder]     `-- [email protected]
[builder]       +-- [email protected]
[builder]       +-- [email protected]
[builder]       | +-- [email protected] deduped
[builder]       | +-- [email protected] deduped
[builder]       | +-- [email protected] deduped
[builder]       | +-- [email protected] deduped
[builder]       | +-- [email protected] deduped
[builder]       | +-- [email protected] deduped
[builder]       | +-- [email protected] deduped
[builder]       | +-- [email protected] deduped
[builder]       | +-- [email protected] deduped
[builder]       | `-- [email protected] deduped
[builder]       `-- [email protected]
[builder]         +-- [email protected]
[builder]         +-- [email protected]
[builder]         +-- [email protected]
[builder]         +-- [email protected]
[builder]         | `-- [email protected]
[builder]         +-- [email protected]
[builder]         +-- [email protected]
[builder]         +-- [email protected]
[builder]         | +-- [email protected]
[builder]         | +-- [email protected] deduped
[builder]         | `-- [email protected] deduped
[builder]         +-- [email protected]
[builder]         | +-- [email protected]
[builder]         | | +-- [email protected]
[builder]         | | +-- [email protected]
[builder]         | | +-- [email protected]
[builder]         | | `-- [email protected]
[builder]         | |   `-- [email protected]
[builder]         | `-- [email protected]
[builder]         +-- [email protected]
[builder]         | +-- [email protected]
[builder]         | +-- [email protected]
[builder]         | | +-- [email protected] deduped
[builder]         | | +-- [email protected]
[builder]         | | +-- [email protected]
[builder]         | | `-- [email protected]
[builder]         | |   +-- [email protected] deduped
[builder]         | |   +-- [email protected] deduped
[builder]         | |   `-- [email protected] deduped
[builder]         | `-- [email protected]
[builder]         |   +-- [email protected]
[builder]         |   | `-- [email protected] deduped
[builder]         |   +-- [email protected] deduped
[builder]         |   +-- [email protected]
[builder]         |   | `-- [email protected] deduped
[builder]         |   +-- [email protected]
[builder]         |   | `-- [email protected] deduped
[builder]         |   +-- [email protected]
[builder]         |   | +-- [email protected] deduped
[builder]         |   | `-- [email protected] deduped
[builder]         |   +-- [email protected]
[builder]         |   | `-- [email protected] deduped
[builder]         |   +-- [email protected]
[builder]         |   +-- [email protected] deduped
[builder]         |   `-- [email protected]
[builder]         +-- [email protected]
[builder]         +-- [email protected]
[builder]         +-- [email protected]
[builder]         +-- [email protected]
[builder]         | `-- [email protected]
[builder]         +-- [email protected]
[builder]         +-- [email protected]
[builder]         +-- [email protected]
[builder]         +-- [email protected] deduped
[builder]         +-- [email protected]
[builder]         | +-- [email protected]
[builder]         | `-- [email protected]
[builder]         +-- [email protected]
[builder]         | `-- [email protected] deduped
[builder]         `-- [email protected]
[builder]     
[builder]     
[builder]     > [email protected] install /workspace/node_modules/sqlite3
[builder]     > node-pre-gyp install --fallback-to-build
[builder]     
[builder]     gyp ERR! find Python 
[builder]     gyp ERR! find Python Python is not set from command line or npm configuration
[builder]     gyp ERR! find Python Python is not set from environment variable PYTHON
[builder]     gyp ERR! find Python checking if "python" can be used
[builder]     gyp ERR! find Python - "python" is not in PATH or produced an error
[builder]     gyp ERR! find Python checking if "python2" can be used
[builder]     gyp ERR! find Python - "python2" is not in PATH or produced an error
[builder]     gyp ERR! find Python checking if "python3" can be used
[builder]     gyp ERR! find Python - "python3" is not in PATH or produced an error
[builder]     gyp ERR! find Python 
[builder]     gyp ERR! find Python **********************************************************
[builder]     gyp ERR! find Python You need to install the latest version of Python.
[builder]     gyp ERR! find Python Node-gyp should be able to find and use Python. If not,
[builder]     gyp ERR! find Python you can try one of the following options:
[builder]     gyp ERR! find Python - Use the switch --python="/path/to/pythonexecutable"
[builder]     gyp ERR! find Python   (accepted by both node-gyp and npm)
[builder]     gyp ERR! find Python - Set the environment variable PYTHON
[builder]     gyp ERR! find Python - Set the npm configuration variable python:
[builder]     gyp ERR! find Python   npm config set python "/path/to/pythonexecutable"
[builder]     gyp ERR! find Python For more information consult the documentation at:
[builder]     gyp ERR! find Python https://github.com/nodejs/node-gyp#installation
[builder]     gyp ERR! find Python **********************************************************
[builder]     gyp ERR! find Python 
[builder]     gyp ERR! configure error 
[builder]     gyp ERR! stack Error: Could not find any Python installation to use
[builder]     gyp ERR! stack     at PythonFinder.fail (/layers/paketo-buildpacks_node-engine/node/lib/node_modules/npm/node_modules/node-gyp/lib/find-python.js:307:47)
[builder]     gyp ERR! stack     at PythonFinder.runChecks (/layers/paketo-buildpacks_node-engine/node/lib/node_modules/npm/node_modules/node-gyp/lib/find-python.js:136:21)
[builder]     gyp ERR! stack     at PythonFinder.<anonymous> (/layers/paketo-buildpacks_node-engine/node/lib/node_modules/npm/node_modules/node-gyp/lib/find-python.js:179:16)
[builder]     gyp ERR! stack     at PythonFinder.execFileCallback (/layers/paketo-buildpacks_node-engine/node/lib/node_modules/npm/node_modules/node-gyp/lib/find-python.js:271:16)
[builder]     gyp ERR! stack     at exithandler (child_process.js:301:5)
[builder]     gyp ERR! stack     at ChildProcess.errorhandler (child_process.js:313:5)
[builder]     gyp ERR! stack     at ChildProcess.emit (events.js:198:13)
[builder]     gyp ERR! stack     at Process.ChildProcess._handle.onexit (internal/child_process.js:246:12)
[builder]     gyp ERR! stack     at onErrorNT (internal/child_process.js:415:16)
[builder]     gyp ERR! stack     at process._tickCallback (internal/process/next_tick.js:63:19)
[builder]     gyp ERR! System Linux 4.19.76-linuxkit
[builder]     gyp ERR! command "/layers/paketo-buildpacks_node-engine/node/bin/node" "/layers/paketo-buildpacks_node-engine/node/lib/node_modules/npm/node_modules/node-gyp/bin/node-gyp.js" "configure" "--fallback-to-build" "--module=/layers/paketo-buildpacks_npm-install/modules/node_modules/sqlite3/lib/binding/node-v64-linux-x64/node_sqlite3.node" "--module_name=node_sqlite3" "--module_path=/layers/paketo-buildpacks_npm-install/modules/node_modules/sqlite3/lib/binding/node-v64-linux-x64" "--napi_version=6" "--node_abi_napi=napi" "--napi_build_version=0" "--node_napi_label=node-v64" "--nodedir=/layers/paketo-buildpacks_node-engine/node"
[builder]     gyp ERR! cwd /layers/paketo-buildpacks_npm-install/modules/node_modules/sqlite3
[builder]     gyp ERR! node -v v10.22.0
[builder]     gyp ERR! node-gyp -v v5.1.0
[builder]     gyp ERR! not ok 
[builder]     node-pre-gyp ERR! build error 
[builder]     node-pre-gyp ERR! stack Error: Failed to execute '/layers/paketo-buildpacks_node-engine/node/bin/node /layers/paketo-buildpacks_node-engine/node/lib/node_modules/npm/node_modules/node-gyp/bin/node-gyp.js configure --fallback-to-build --module=/layers/paketo-buildpacks_npm-install/modules/node_modules/sqlite3/lib/binding/node-v64-linux-x64/node_sqlite3.node --module_name=node_sqlite3 --module_path=/layers/paketo-buildpacks_npm-install/modules/node_modules/sqlite3/lib/binding/node-v64-linux-x64 --napi_version=6 --node_abi_napi=napi --napi_build_version=0 --node_napi_label=node-v64 --nodedir=/layers/paketo-buildpacks_node-engine/node' (1)
[builder]     node-pre-gyp ERR! stack     at ChildProcess.<anonymous> (/layers/paketo-buildpacks_npm-install/modules/node_modules/sqlite3/node_modules/node-pre-gyp/lib/util/compile.js:83:29)
[builder]     node-pre-gyp ERR! stack     at ChildProcess.emit (events.js:198:13)
[builder]     node-pre-gyp ERR! stack     at maybeClose (internal/child_process.js:982:16)
[builder]     node-pre-gyp ERR! stack     at Process.ChildProcess._handle.onexit (internal/child_process.js:259:5)
[builder]     node-pre-gyp ERR! System Linux 4.19.76-linuxkit
[builder]     node-pre-gyp ERR! command "/layers/paketo-buildpacks_node-engine/node/bin/node" "/workspace/node_modules/sqlite3/node_modules/.bin/node-pre-gyp" "install" "--fallback-to-build"
[builder]     node-pre-gyp ERR! cwd /layers/paketo-buildpacks_npm-install/modules/node_modules/sqlite3
[builder]     node-pre-gyp ERR! node -v v10.22.0
[builder]     node-pre-gyp ERR! node-pre-gyp -v v0.11.0
[builder]     node-pre-gyp ERR! not ok 
[builder]     Failed to execute '/layers/paketo-buildpacks_node-engine/node/bin/node /layers/paketo-buildpacks_node-engine/node/lib/node_modules/npm/node_modules/node-gyp/bin/node-gyp.js configure --fallback-to-build --module=/layers/paketo-buildpacks_npm-install/modules/node_modules/sqlite3/lib/binding/node-v64-linux-x64/node_sqlite3.node --module_name=node_sqlite3 --module_path=/layers/paketo-buildpacks_npm-install/modules/node_modules/sqlite3/lib/binding/node-v64-linux-x64 --napi_version=6 --node_abi_napi=napi --napi_build_version=0 --node_napi_label=node-v64 --nodedir=/layers/paketo-buildpacks_node-engine/node' (1)
[builder]     npm ERR! code ELIFECYCLE
[builder]     npm ERR! errno 1
[builder]     npm ERR! [email protected] install: `node-pre-gyp install --fallback-to-build`
[builder]     npm ERR! Exit status 1
[builder]     npm ERR! 
[builder]     npm ERR! Failed at the [email protected] install script.
[builder]     npm ERR! This is probably not a problem with npm. There is likely additional logging output above.
[builder]     
[builder]     npm ERR! A complete log of this run can be found in:
[builder]     npm ERR!     /home/cnb/.npm/_logs/2020-09-25T15_10_10_126Z-debug.log
[builder]     
[builder] 
[builder] ERROR: failed to build: exit status 1
ERROR: failed to build: executing lifecycle. This may be the result of using an untrusted builder: failed with status code: 145

Proposed implementation

During build phase, see if the vendored/downloaded node_modules contain native extensions.

This could be checked by detecting the presence of the binding.gyp file at the root of every module.
E.g. https://github.com/paketo-buildpacks/npm-install/blob/v0.2.0/integration/testdata/vendored/node_modules/sqlite3/binding.gyp
If it contains native extensions, check for the build image supports compiling native extensions

Maybe check for some heuristics like python
If the app contains native extensions and is using a build image that can't support compiling it, fail build with appropriate error message logged.

Chmod fails when running as non-root user

This buildpack runs chmod on the project's directory.

Expected Behavior

Buildpacks is able to continue on userspace (non-root) execution.

Current Behavior

Fails on chmod, e.g.:

Paketo NPM Install Buildpack 0.10.0
  Resolving installation process
    Process inputs:
      node_modules      -> "Not found"
      npm-cache         -> "Not found"
      package-lock.json -> "Found"
    Selected NPM build process: 'npm ci'
  Executing build environment install process
    Running 'npm ci --unsafe-perm --cache /layers/paketo-buildpacks_npm-install/npm-cache'
      Completed in 35.006s
  Configuring build environment
    NODE_ENV -> "development"
    PATH     -> "$PATH:/layers/paketo-buildpacks_npm-install/build-modules/node_modules/.bin"
  Generating SBOM for /layers/paketo-buildpacks_npm-install/build-modules
chmod /builds/p2s/gp2s-search/gp2s-search-frontend: operation not permitted

Possible Solution

Continue if chmod failed.

Steps to Reproduce

Run the buildpack with non-root privileges, i.e. a .gitlab-ci.yaml

stages:
  - build

default:
  tags:
    - linux
    - amd64
    - docker
 
build-image:
  stage: build
  image: paketobuildpacks/builder:full
  # Access to GitLab Container Registry for Paketo lifecycle
  before_script:
    - mkdir ~/.docker
    - echo "{\"auths\":{\"$CI_REGISTRY\":{\"username\":\"$CI_REGISTRY_USER\",\"password\":\"$CI_JOB_TOKEN\"}}}" >> ~/.docker/config.json
  variables:
    PLATFORM_DIR: /tmp/platform
  script:
    # creator binary doesn't read environment variables, but reads platform files.
    # Defining variables as per the the Platform Interface
    # https://github.com/buildpacks/spec/blob/main/platform.md#user-provided-variables
    - cp -r /platform "$PLATFORM_DIR"
    - echo build > "$PLATFORM_DIR/env/BP_NODE_RUN_SCRIPTS"
    - /cnb/lifecycle/creator
      -platform "$PLATFORM_DIR"
      -app=.
      $CI_REGISTRY_IMAGE:latest

Motivations

I'd like to be able to use newer paketo buildpacks in userspace builds.

Ensure that .npmrc is tested

Context
The v2b nodejs-buildpack allowed uses to pass in a .npmrc file with their node applications. This could be used to specify private npm repos to install dependencies from.
We use it here in the old buildpack

Proposal
We have no explicit .npmrc support when porting functionallity over into the nodejs cf compatible-cnb and need to add it back in.
Does npm automatically handle this?

If so we should add some testing around it

Notes
We should add some testing & validation around this.

Restarting o Docker Container results in errors executing the symlink script.

One have to forcefully recreate the docker container to get everything working again.

Expected Behavior

After a docker restart everything should startup correcty

Current Behavior

2022/07/26 13:17:22 symlink /layers/paketo-buildpacks_npm-install/launch-modules/node_modules /tmp/node_modules: file exists
ERROR: failed to launch: exec.d: failed to execute exec.d file at path '/layers/paketo-buildpacks_npm-install/launch-modules/exec.d/0-setup-symlinks': exit status 1
2022/07/26 13:17:31 symlink /layers/paketo-buildpacks_npm-install/launch-modules/node_modules /tmp/node_modules: file exists
ERROR: failed to launch: exec.d: failed to execute exec.d file at path '/layers/paketo-buildpacks_npm-install/launch-modules/exec.d/0-setup-symlinks': exit status 1

Possible Solution

I suggest that is releated to change of the temporary node_modules symlink change. Maybe one can delete that symlink again if already exists.

Steps to Reproduce

start a container build with buildpack
restart the container

Motivations

Detection outputs log messages and should be silent

Currently the npm buildpack prints output to stdout:

[detector] Trying group of 5...
[detector] ======== Output: NPM Buildpack ========
[detector] no "package.json" found at: /workspace/app/package.json
[detector] ======== Results ========
[detector] Node.js Buildpack: pass
[detector] Python Buildpack: pass
[detector] NPM Buildpack: fail
[detector] Node Function Buildpack: fail
[detector] Pivotal New Relic Buildpack: skip
[detector] Trying group of 4...
[detector] ======== Output: NPM Buildpack ========
[detector] no "package.json" found at: /workspace/app/package.json
[detector] ======== Results ========
[detector] Node.js Buildpack: pass
[detector] Python Buildpack: pass
[detector] NPM Buildpack: fail
[detector] Pivotal New Relic Buildpack: skip
[detector] Trying group of 1...
[detector] ======== Results ========
[detector] Command Function Buildpack: pass

This output is unnecessary and should only be output as debug logging.

We should document the npmrc binding

I am not sure if this is a generally followed convention in the Paketo project, but I like the fact that e.g. the maven buildpack documents the supported bindings in the README.md and would appreciate, if the npm install buildpack could do the same.

Rebuild of simple node app using build service fails due to build step error

What version of Cloud Foundry and CF CLI are you using? (i.e. What is the output of running cf curl /v2/info && cf version?

What version of the buildpack you are using?

0.0.15

If you were attempting to accomplish a task, what was it you were attempting to do?

Rebuild a simple node app using build service

What did you expect to happen?

Rebuild succeeds

What was the actual behavior?

Error triggered during NPM build step

[build-step-build] unable to copy "/workspace/node_modules" to "/layers/org.cloudfoundry.npm/node_modules": error while creating '/layers/org.cloudfoundry.npm/node_modules/node_modules/.bin/esparse' as symlink to '../esprima/bin/esparse.js': symlink ../esprima/bin/esparse.js /layers/org.cloudfoundry.npm/node_modules/node_modules/.bin/esparse: file exists
[build-step-build] Error: failed to build: exit status 103

Can you provide a sample app?

https://github.com/node-modules

Please confirm where necessary:

[x ] I have included a log output
[x ] My log includes an error message
[x ] I have included steps for reproduction

Comment from @ndon55555

It seems like we don't handle the case where an app is vendored without a package-lock.json very well.

Apps that use ng build fail to start with "build Module not found: Error: Recursion in resolving"

Application containers that have been built with the NPM buildpack and use the ng build command face the error: Module not found: Error: Recursion in resolving when using Angular 10. This issue filed for the angular-cli indicates that the issue can be caused by the node_modules directory containing symlinks.

The NPM buildpack creates a symlink for the node_modules directory during its install process. This seems to be the root cause of the error.

Developers can work around the issue by adding the following to the angular.json file in the application source directory:

{
"architect" : {
  "build" : {
    "options" : {
      "preserveSymlinks" : true
   }
  }
 } 
}

This workaround should be documented or the buildpack should address this problem itself.

`package-lock.json` should not be required

What version of Cloud Foundry and CF CLI are you using? (i.e. What is the output of running cf curl /v2/info && cf version?

packs v0.0.9

What version of the buildpack you are using?

5c4c6ec

If you were attempting to accomplish a task, what was it you were attempting to do?

Build a project with a package.json file but no package-lock.json.

Many projects will not have a package-lock.json as it's not required by npm, even though it is encouraged. If a project contains an npm-shrinkwrap.json file, the package-lock.json is completely ignored. Many npm alternatives will not generate a package-lock.json file.

What did you expect to happen?

The buildpack should detect and run npm install at build time.

What was the actual behavior?

The buildpack detects, but errors at buildtime.

[detector] 2019/01/25 19:42:37 NPM Buildpack: pass
...
[builder] -----> Node.js Buildpack 0.0.2
[builder] -----> NodeJS 11.4.0: Contributing to layer
[builder]        Downloading from https://nodejs.org/dist/v11.4.0/node-v11.4.0-linux-x64.tar.gz
[builder]        Verifying checksum
[builder]        Expanding to /workspace/org.cloudfoundry.buildpacks.nodejs/node
[builder]        Writing NODE_HOME to shared
[builder]        Writing NODE_ENV to shared
[builder]        Writing NODE_MODULES_CACHE to shared
[builder]        Writing NODE_VERBOSE to shared
[builder]        Writing NPM_CONFIG_PRODUCTION to shared
[builder]        Writing NPM_CONFIG_LOGLEVEL to shared
[builder]        Writing WEB_MEMORY to shared
[builder]        Writing WEB_CONCURRENCY to shared
[builder] -----> NPM Buildpack 0.0.3
[builder] unable to find "package-lock.json"
[builder] 2019/01/25 19:42:45 Error: failed to : exit status 102

Can you provide a sample app?

https://github.com/projectriff-samples/node-square/tree/10ee582a990eab43772f7d99d715740ddcee2b1b

Use projectriff/builder:0.2.0-snapshot-ci-f2315fde2cae as the builder image.

Please confirm where necessary:

I have included a log output
My log includes an error message
I have included steps for reproduction

Install `devDependencies` during build time

This buildpack should reflect the behavior that was brought about in yarn-install by this issue paketo-buildpacks/yarn-install#314. It is not an uncommon pattern for users to put static site building modules in their devDependenices and with the upcoming frontendJS support coming to the web-servers buildpack we should enable users to have these dependencies during build.

Failure: Create Draft Release workflow

Create Draft Release workflow failed.

There's no way to clean up node_modules after building

Some users may want to have their node_modules removed after generating some set of static assets akin to the source removal concept in the Go buildpack. Perhaps we should consider allowing users to opt-in to this workflow for the Node.js buildpack family as well.

Enable Debug Logging

With the merging of RFC 27 buildpacks should respect the BP_LOG_LEVEL environment variable and allow for debugging logging.

A good example of how to minimally implement this feature can be found in Go Build.

node_modules should be rebuilt if version of node changes between builds

What happened?

Similar to paketo-buildpacks/yarn-install#144, buildpack reuses cached version of node_modules even when version of node has changed between builds. For apps with native extensions, this can cause failures at runtime though the build succeeds.

Reproduction Steps

Using

 ‣ pack --version
0.13.1+git-4134cc6.build-1135

Clone this sample app [email protected]:fg-j/native-extensions-sample.git
Build the app (and force the cache to be cleared) pack build with-bcrypt -b gcr.io/paketo-buildpacks/nodejs:0.0.10 --builder paketobuildpacks/builder:0.1.20-base --clear-cache
Run the app docker run -d --env PORT=8080 --publish 8080:8080 with-bcrypt
Curl the app endpoint curl 0.0.0.0:8080. Expected output is: Hello, World!
Update the desired version of node by changing buildpack.yml to:

---
nodejs:
  version: ^14.0.0

Rebuild the app (but don't force the cache to be cleared) pack build with-bcrypt -b gcr.io/paketo-buildpacks/nodejs:0.0.10 --builder paketobuildpacks/builder:0.1.20-base The output should contain:

[builder] Paketo Node Engine Buildpack 0.1.2
[builder]   Resolving Node Engine version
[builder]     Candidate version sources (in priority order):
[builder]       buildpack.yml -> "^14.0.0"
[builder]                     -> ""
[builder]       <unknown>     -> "*"
[builder]
[builder]     Selected Node Engine version (using buildpack.yml): 14.13.0
...
...
...
[builder] Paketo NPM Install Buildpack 0.2.1
[builder]   Resolving installation process
[builder]     Process inputs:
[builder]       node_modules      -> "Not found"
[builder]       npm-cache         -> "Not found"
[builder]       package-lock.json -> "Found"
[builder]
[builder]     Selected NPM build process: 'npm ci'
[builder]
[builder]   Reusing cached layer /layers/paketo-buildpacks_npm-install/modules

This indicates that the cached version of the node_modules has been reused, rather than rebuilding for the new node version.

Stop the previously running instance of the app (e.g. docker stop 83e251bd0c449a7fbfea20b742ffd5b4b5dbf885307e3c26da0a0c8d7a647254)
Run the newly built version of the app: docker run -d --env PORT=8080 --publish 8080:8080 with-bcrypt
Curl the app endpoint curl 0.0.0.0:8080. Desired output is: Hello, World! but actual output is:

curl: (7) Failed to connect to 0.0.0.0 port 8080: Connection refused

Get logs for the container (e.g. docker logs f025c0b9c318) Expected output:

internal/modules/cjs/loader.js:1144
  return process.dlopen(module, path.toNamespacedPath(filename));
                 ^

Error: The module '/layers/paketo-buildpacks_npm-install/modules/node_modules/bcrypt/lib/binding/bcrypt_lib.node'
was compiled against a different Node.js version using
NODE_MODULE_VERSION 72. This version of Node.js requires
NODE_MODULE_VERSION 83. Please try re-compiling or re-installing
the module (for instance, using `npm rebuild` or `npm install`).
    at Object.Module._extensions..node (internal/modules/cjs/loader.js:1144:18)
    at Module.load (internal/modules/cjs/loader.js:950:32)
    at Function.Module._load (internal/modules/cjs/loader.js:791:14)
    at Module.require (internal/modules/cjs/loader.js:974:19)
    at require (internal/modules/cjs/helpers.js:88:18)
    at Object.<anonymous> (/layers/paketo-buildpacks_npm-install/modules/node_modules/bcrypt/bcrypt.js:6:16)
    at Module._compile (internal/modules/cjs/loader.js:1085:30)
    at Object.Module._extensions..js (internal/modules/cjs/loader.js:1114:10)
    at Module.load (internal/modules/cjs/loader.js:950:32)
    at Function.Module._load (internal/modules/cjs/loader.js:791:14)

This shows that the app fails to run as expected because bcrypt was compiled with a different version of node than the one that is installed in the app container.

Checklist

Please confirm the following:

I have included log output.
The log output includes an error message.
I have included steps for reproduction.

Investigate what metadata can be retrieved for npm-install modules

As a part of our BOM work outlined in this RFC, we would like to support some type of BOM metadata for modules provided by buildpacks like npm-install.

We should investigate the extent of data that can be extracted around the following for the modules provided by this buildpack:

All of the the other information (SHA, URI, etc for each module)
License information
CPEs

Acceptance

The outcome of this issue should be more issues that outline the work needed to implement viable metadata as a result of this investigation.

Dependabot wasn't able to update github.com/cloudfoundry/occam

The module path github.com/cloudfoundry/occam found in your /go.mod doesn't match the actual path github.com/paketo-buildpacks/occam found in the dependency's go.mod.

Updating the module path in your go.mod to github.com/paketo-buildpacks/occam should resolve this issue.

View the update logs.

A project with cached dependencies fails to start on subsequent builds

When building a project with npm dependencies, the first build succeeds and the image runs as expected. Subsequent builds complete successfully, but cached npm modules cannot be found when the container starts. This appears to only happen if there exists a package-lock.json file and the node_modules folder does not exist.

Possibly relevant

When the package-lock.json file exists, but no node_modules folder exists, the buildpack command is npm ci.
When there exists a package-lock.json file and a node_modules folder, the command becomes npm rebuild.

Expected Behavior

The cached dependencies should be available to the Node.js process when the container starts without requiring a build from a directory with dependencies installed locally.

Current Behavior

When running a container from a project that has been built twice, with each build occurring without a local node_modules folder...
On container startup the cached dependencies cannot be found, and the user receives an error similar to that shown below.

❯ docker run --rm -p 8080:8080 -it quay.io/lanceball/bar
node:internal/modules/cjs/loader:936
  throw err;
  ^

Error: Cannot find module 'opossum'
Require stack:
- /workspace/index.js
    at Function.Module._resolveFilename (node:internal/modules/cjs/loader:933:15)
    at Function.Module._load (node:internal/modules/cjs/loader:778:27)
    at Module.require (node:internal/modules/cjs/loader:1005:19)
    at require (node:internal/modules/cjs/helpers:102:18)
    at Object.<anonymous> (/workspace/index.js:2:11)
    at Module._compile (node:internal/modules/cjs/loader:1105:14)
    at Object.Module._extensions..js (node:internal/modules/cjs/loader:1159:10)
    at Module.load (node:internal/modules/cjs/loader:981:32)
    at Function.Module._load (node:internal/modules/cjs/loader:822:12)
    at Function.executeUserEntryPoint [as runMain] (node:internal/modules/run_main:77:12) {
  code: 'MODULE_NOT_FOUND',
  requireStack: [ '/workspace/index.js' ]
}

Possible Solution

I have only just stumbled on this issue and have not dug into the buildpack to figure it out.

Steps to Reproduce

Create a package.json file in an empty directory with the following contents. It doesn't matter what the dependency is, I'm just using opossum here because it's one I am familiar with and it has no dependencies of its own, so that should keep things simple.

{
  "name": "bar",
  "version": "1.0.0",
  "description": "",
  "main": "index.js",
  "scripts": {
    "start": "node index.js",
    "test": "echo \"Error: no test specified\" && exit 1"
  },
  "keywords": [],
  "author": "",
  "license": "ISC",
  "dependencies": {
    "opossum": "^6.4.0"
  }
}

Create an index.js file in the same directory with the following contents. Not actually using the dependency here, just illustrating the problem.

var http = require('http');
const A = require('opossum');

http.createServer(function (req, res) {
  res.write('Hello World!');
  res.end();
}).listen(8080);

Run npm install && rm -rf node_modules to generate a package-lock.json file for the project
Run pack build --builder gcr.io/paketo-buildpacks/builder:base <image-name> to build an image
Run the image docker run --rm -it -p 8080:8080 <image-name> - it works as expected. In another terminal you can run curl http://localhost:8080 to confirm
Make a change to index.js
Re build with the same pack command above
Run the same docker command above
See an error

❯ docker run --rm -p 8080:8080 -it quay.io/lanceball/bar
node:internal/modules/cjs/loader:936
  throw err;
  ^

Error: Cannot find module 'opossum'
Require stack:
- /workspace/index.js
    at Function.Module._resolveFilename (node:internal/modules/cjs/loader:933:15)
    at Function.Module._load (node:internal/modules/cjs/loader:778:27)
    at Module.require (node:internal/modules/cjs/loader:1005:19)
    at require (node:internal/modules/cjs/helpers:102:18)
    at Object.<anonymous> (/workspace/index.js:2:11)
    at Module._compile (node:internal/modules/cjs/loader:1105:14)
    at Object.Module._extensions..js (node:internal/modules/cjs/loader:1159:10)
    at Module.load (node:internal/modules/cjs/loader:981:32)
    at Function.Module._load (node:internal/modules/cjs/loader:822:12)
    at Function.executeUserEntryPoint [as runMain] (node:internal/modules/run_main:77:12) {
  code: 'MODULE_NOT_FOUND',
  requireStack: [ '/workspace/index.js' ]
}

Motivations

It is causing user headaches in Knative Node.js function projects. See knative/func#1131

Project with a linked module fails with "Module not found"

Expected Behavior

Buildpack should be able to do npm run build without errors.

Current Behavior

Building with buildpacks, with the example project, fails with "Module not found" error.

Paketo Buildpack for Node Run Script 1.0.4
  Executing build process
    Running 'npm run build'
      
      > [email protected] build
      > react-scripts build
      
      Creating an optimized production build...
      Failed to compile.
      
      Module not found: Error: Can't resolve '@my-dummy-namespace/dummy-component' in '/workspace/src'

Building directly with npm works, npm install, npm run build complete without errors.

Project structure and approach to using linked modules follows this example: https://www.developerway.com/posts/react-project-structure

Possible Solution

Steps to Reproduce

Minimal working example is at https://github.com/jansu76/react-problem
To reproduce error:

checkout
cd reactapp
/build-buildpacks.sh

Motivations

I am unable to use buildpacks to build a larger project which uses this type of linked modules extensively.

Use libcfbuildpack identity interface

https://github.com/cloudfoundry/npm-cnb/blob/0da048e762e18d4c8106860f7d9733ceae86ab27/modules/modules.go#L45

Should use: https://github.com/cloudfoundry/libcfbuildpack/blob/master//logger/identifiable.go#L24:6

Failure: Create Draft Release workflow

Create Draft Release workflow failed.

How do I exclude local 'node_modules' folder from the build ?

What happened?

I run the following command at the root of my angular project pack build myapp-gui --buildpack gcr.io/paketo-buildpacks/nodejs that fails with the following dump

[builder] Paketo NPM Install Buildpack 0.4.0
[builder]   Resolving installation process
[builder]     Process inputs:
[builder]       node_modules      -> "Found"
[builder]       npm-cache         -> "Not found"
[builder]       package-lock.json -> "Found"
[builder]
[builder]     Selected NPM build process: 'npm rebuild'
[builder]
[builder]   Executing build process
[builder] vendored node_modules have unmet dependencies: npm list failed: exit status 1
[builder]     npm WARN read-shrinkwrap This version of npm is compatible with lockfileVersion@1, but package-lock.json was generated for lockfileVersion@2. I'll try to do my best with it!
[builder]     [email protected] /workspace
[builder]     +-- UNMET DEPENDENCY @angular/[email protected]
[builder]     | `-- UNMET DEPENDENCY [email protected]
[builder]     +-- UNMET DEPENDENCY @angular/[email protected]
[builder]     | `-- UNMET DEPENDENCY [email protected]
[builder]     +-- UNMET DEPENDENCY @angular/[email protected]
[builder]     | `-- UNMET DEPENDENCY [email protected]
[builder]     +-- UNMET DEPENDENCY @angular/[email protected]

What were you attempting to do?

after spending few hours understanding the cryptic error, I finally got it: I build my project locally using vscode and the ng build and the node_modules directory has been created locally, mistaking the buildpack that expected to run npm rebuild

What did you expect to happen?
What was the actual behavior? Please provide log output, if possible.
as soon as I removed it, I finally succeeded to build my image.

but the dev experience is weak, I can use the ng serve without having a conflict with the build of the image using the buildpack. So I'm wondering if there is an option to exclude folders from the build process or other configuration tips to not include folders into the build process.

Build Configuration

What platform (pack, kpack, tekton buildpacks plugin, etc.) are you
using? Please include a version.

pack version
0.19.0+git-360dbae.build-2550

Checklist

I have included log output.
The log output includes an error message.
I have included steps for reproduction.

Conform to RFC0043: Reproducible Builds

To conform to RFC0043 this buildpack should ensure that builds are reproducible. Specifically it should not include a built_at metadata field. In the tests that leverage this field to assert layer reuse, we should instead compare layer SHA values across rebuilds.

See also the tracking issue: paketo-buildpacks/rfcs#165.

Don't fail in the absence of `node_modules`

Just because there is a package.json file doesn't mean there are dependencies. This is especially true for simple riff functions.

Build should error if there is an unmet dependency in vendored app on rebuild

What happened?

When rebuilding an app with vendored dependencies, the build succeeded despite the app source node_modules not containing all the necessary vendored dependencies. The cached node_modules were reused, which were missing the needed dependency. The app built successfully but then failed to run.

The expected behaviour here is that the build fails because there are unmet dependencies.

Reproduction Steps:

Install pack. I used

pack --version
0.13.1+git-4134cc6.build-1135

Clone this sample app
Edit package.json in the app to exclude the "grunt-steroids": "0.2.3" dependency.
Run npm install locally. This will populate node_modules with the necessary dependencies for the app. It will also update the package-lock.json to exclude the removed dependency.
pack build unmet-dep -b gcr.io/paketo-buildpacks/nodejs:0.0.10 --builder paketobuildpacks/builder:0.1.20-base --clear-cache . This should succeed and use the npm rebuild command.
Then, re-add the "grunt-steroids": "0.2.3" to the package.json and run npm install --package-lock-only. The app now contains an unmet dependency, but the package.json and package-lock.json are in sync.
Rebuild the app: pack build unmet-dep -b gcr.io/paketo-buildpacks/nodejs:0.0.10 --builder paketobuildpacks/builder:0.1.20-base
The output should contain:

[builder] Paketo NPM Install Buildpack 0.2.1
[builder]   Resolving installation process
[builder]     Process inputs:
[builder]       node_modules      -> "Found"
[builder]       npm-cache         -> "Not found"
[builder]       package-lock.json -> "Found"
[builder]
[builder]     Selected NPM build process: 'npm rebuild'
[builder]
[builder]   Reusing cached layer /layers/paketo-buildpacks_npm-install/modules
[builder]

The buildpack reuses the cached version of the node_modules which does not contain the grunt_steroids dependency, rather than failing with an unmet dependencies error. If you then run

pack build unmet-dep  -b gcr.io/paketo-buildpacks/nodejs:0.0.10 --builder paketobuildpacks/builder:0.1.20-base --clear-cache

The build will fail with an error that makes sense:

[builder] vendored node_modules have unmet dependencies: npm list failed: exit status 1
[builder]     | +-- [email protected]
[builder]     | | +-- [email protected] deduped
[builder]     | | +-- [email protected] deduped
[builder]     | | +-- [email protected] deduped
[builder]     | | `-- [email protected] deduped
[builder]     | +-- [email protected]
[builder]     | +-- [email protected]
[builder]     | +-- [email protected]
[builder]     | | +-- [email protected]
[builder]     | | `-- [email protected] deduped
[builder]     | +-- [email protected]
[builder]     | `-- [email protected]
[builder]     +-- UNMET DEPENDENCY [email protected]
[builder]     | +-- UNMET DEPENDENCY [email protected]
[builder]     | | +-- UNMET DEPENDENCY [email protected]
[builder]     | | `-- UNMET DEPENDENCY [email protected]
[builder]     | +-- UNMET DEPENDENCY [email protected]
[builder]     | +-- UNMET DEPENDENCY [email protected]
[builder]     | `-- UNMET DEPENDENCY [email protected]
[builder]     |   +-- UNMET DEPENDENCY [email protected]
[builder]     |   `-- UNMET DEPENDENCY [email protected]
[builder]     `-- [email protected]
[builder]       +-- [email protected]
[builder]       | `-- [email protected] deduped
[builder]       `-- [email protected]
[builder]
[builder]     npm ERR! missing: [email protected], required by [email protected]
[builder]     npm ERR! missing: [email protected], required by [email protected]
[builder]     npm ERR! missing: [email protected], required by [email protected]
[builder]     npm ERR! missing: [email protected], required by [email protected]
[builder]     npm ERR! missing: [email protected], required by [email protected]
[builder]     npm ERR! missing: [email protected], required by [email protected]
[builder]     npm ERR! missing: [email protected], required by [email protected]
[builder]     npm ERR! missing: [email protected], required by [email protected]
[builder]     npm ERR! missing: [email protected], required by [email protected]

Checklist

Please confirm the following:

I have included log output.
The log output includes an error message.
I have included steps for reproduction.

exec.d file needs to be checked to during rebuild

During a rebuild the buildpack blindly assumes that the exec.d file in the buildpack has not changed between builds. This could lead to potentially incorrect rebuild behavior when the buildpack reuses the old layer with a stale exec.d process. We should verify that the exec.d process is the same on rebuild.

Failure: Go get update workflow

Go get update workflow failed.
Please take a look to ensure CVE patches can be released. (cc @pivotal-cf/commercial-buildpacks).

/tmp/node_modules directory is missing during run time

The latest npm_install buildpack is removing the /tmp/node_modules directory after build. Older buildpacks eg 0.7.1 used the directory /layers/paketo-buildpacks_npm-install/modules/node_modules, which persisted.

Expected Behavior

/tmp/node_modules should exist

Current Behavior

/tmp/node_modules is being removed

Possible Solution

No need to remove it or just store node_modules elsewhere.

Steps to Reproduce

Motivations

Our application is looking for packages that are installed in the /workspace/node_module directory during run time. Not having this here is caused the application to fail. Other npm-install buildpacks (eg Heroku, cloud-foundry) do not remove this directory and I can see from your older release (0.7.1) that this was not removed. Can this behaviour be reverted back? Or at least have an option to not remove that directory.

Different run-image and build-image users causing runtime failure

What happened?

This RFC outlines how runtime modifications should be avoided. This can be achieved by having separate users for the run-time and build-time images.

What were you attempting to do?
Build and run my application's image, with different run-time and build-time user ids.
What did you expect to happen?
Build and run the my application successfully.
What was the actual behavior? Please provide log output, if possible.
As runtime modifications are made through the setup-symlinks script, I am unable to run my applications image. Instead we get the following error:

2022/04/20 16:45:46 unlinkat /workspace/node_modules: operation not permitted

Build Configuration

What platform (pack, kpack, tekton buildpacks plugin, etc.) are you
using? Please include a version.

pack v0.24.1

Reproducing
The issue can be reproduced here: https://github.com/g-suraj/npm_uid_issue
./make.sh and then run then docker run test_image

Checklist

I have included log output.
The log output includes an error message.
I have included steps for reproduction.

Generate SBOM for node_modules

To implement Paketo RFC0038, this buildpack will need to move from storing SBOM information in layer metadata to storing it in files that the CNB lifecycle can manipulate during the build. The RFC outlines what these files are and what they should contain.

NPM buildpack should allow users to force which npm command runs

Currently, the install command that the NPM buildpack runs depends on which files are present in an application's source code. Either npm install npm ci or npm rebuild will be used.

We have seen a case where the angular CLI is not properly installed in an app container because the NPM buildpack runs npm ci instead of npm install. A workaround was to remove the package-lock.json from the app's source code. This caused the buildpack to run npm install, and resolved the problem.

But removing a package-lock.json from source code is not a great long-term solution because it prevents developers from locking their node modules to specific versions.

There should be a way (perhaps via an environment variable set at container build time) for developers to specify which npm installation command the buildpack should run.

Build should error if package.json and package-lock.json are out of sync

The buildpack doesn't realize that it needs to run npm install instead of npm ci in the situation where the developer has forgotten to update their package-lock.json file.

Replication steps

Create a Node.js app with the following package.json

{
  "name": "myapp",
  "devDependencies": {
    "chalk-cli": "~4.1.0"
  },
  "scripts": {
    "start": "chalk red bold 'Unicorns & Rainbows'"
  }
}

Run npm install --package-lock-only in the source directory

Run pack build myapp --buildpack gcr.io/paketo-buildpacks/nodejs. You should see logs like the following:

===> DETECTING
[detector] paketo-buildpacks/node-engine 0.0.262
[detector] paketo-buildpacks/npm         0.1.80
===> ANALYZING
[analyzer] Previous image with name "index.docker.io/library/myapp:latest" not found
===> RESTORING
===> BUILDING
[builder] Node Engine Buildpack 0.0.262
[builder]   Resolving Node Engine version
[builder]     Candidate version sources (in priority order):
[builder]        -> "*"
[builder]
[builder]     Selected Node Engine version (using ): 10.22.0
[builder]
[builder]   Executing build process
[builder]     Installing Node Engine 10.22.0
[builder]       Completed in 8.517s
[builder]
[builder]   Configuring environment
[builder]     NODE_ENV     -> "production"
[builder]     NODE_HOME    -> "/layers/paketo-buildpacks_node-engine/node"
[builder]     NODE_VERBOSE -> "false"
[builder]
[builder]     Writing profile.d/0_memory_available.sh
[builder]       Calculates available memory based on container limits at launch time.
[builder]       Made available in the MEMORY_AVAILABLE environment variable.
[builder]
[builder] NPM Buildpack 0.1.80
[builder]   Resolving installation process
[builder]     Process inputs:
[builder]       node_modules      -> "Not found"
[builder]       npm-cache         -> "Not found"
[builder]       package-lock.json -> "Found"
[builder]
[builder]     Selected NPM build process: 'npm ci'
[builder]
[builder]   Executing build process
[builder]     Running 'npm ci --unsafe-perm --cache /layers/paketo-buildpacks_npm/npm-cache'
[builder]       Completed in 966ms
[builder]
[builder]   Configuring environment
[builder]     NPM_CONFIG_LOGLEVEL   -> "error"
[builder]     NPM_CONFIG_PRODUCTION -> "true"
[builder]     PATH                  -> "$PATH:/layers/paketo-buildpacks_npm/modules/node_modules/.bin"
===> EXPORTING
[exporter] Adding layer 'paketo-buildpacks/node-engine:node'
[exporter] Adding layer 'paketo-buildpacks/npm:modules'
[exporter] Adding 1/1 app layer(s)
[exporter] Adding layer 'launcher'
[exporter] Adding layer 'config'
[exporter] Adding layer 'process-types'
[exporter] Adding label 'io.buildpacks.lifecycle.metadata'
[exporter] Adding label 'io.buildpacks.build.metadata'
[exporter] Adding label 'io.buildpacks.project.metadata'
[exporter] Setting default process type 'web'
[exporter] *** Images (6153d789a581):
[exporter]       index.docker.io/library/myapp:latest
[exporter] Adding cache layer 'paketo-buildpacks/node-engine:node'
Successfully built image myapp

Run docker run -it myapp. You should see that it cannot find the chalk command as that was in the devDependencies section of our package.json.

> myapp@ start /workspace
> chalk red bold 'Unicorns & Rainbows'

sh: 1: chalk: not found
npm ERR! code ELIFECYCLE
npm ERR! syscall spawn
npm ERR! file sh
npm ERR! errno ENOENT
npm ERR! myapp@ start: `chalk red bold 'Unicorns & Rainbows'`
npm ERR! spawn ENOENT
npm ERR!
npm ERR! Failed at the myapp@ start script.
npm ERR! This is probably not a problem with npm. There is likely additional logging output above.

npm ERR! A complete log of this run can be found in:
npm ERR!     /home/cnb/.npm/_logs/2020-09-16T17_04_01_831Z-debug.log

Update the package.json to move the chalk-cli from devDependencies to dependencies. This should make it so that it is available on the $PATH and callable in our start command.

{
  "name": "myapp",
  "dependencies": {
    "chalk-cli": "~4.1.0"
  },
  "scripts": {
    "start": "chalk red bold 'Unicorns & Rainbows'"
  }
}

Run pack build myapp --buildpack gcr.io/paketo-buildpacks/nodejs. NOTE: we did not update the package-lock.json. Also note in the logs that the node_modules layer is reused. You should see logs like the following:

===> DETECTING
[detector] paketo-buildpacks/node-engine 0.0.262
[detector] paketo-buildpacks/npm         0.1.80
===> ANALYZING
[analyzer] Restoring metadata for "paketo-buildpacks/node-engine:node" from app image
[analyzer] Restoring metadata for "paketo-buildpacks/npm:modules" from app image
===> RESTORING
[restorer] Restoring data for "paketo-buildpacks/node-engine:node" from cache
===> BUILDING
[builder] Node Engine Buildpack 0.0.262
[builder]   Resolving Node Engine version
[builder]     Candidate version sources (in priority order):
[builder]        -> "*"
[builder]
[builder]     Selected Node Engine version (using ): 10.22.0
[builder]
[builder]   Reusing cached layer /layers/paketo-buildpacks_node-engine/node
[builder]
[builder] NPM Buildpack 0.1.80
[builder]   Resolving installation process
[builder]     Process inputs:
[builder]       node_modules      -> "Not found"
[builder]       npm-cache         -> "Not found"
[builder]       package-lock.json -> "Found"
[builder]
[builder]     Selected NPM build process: 'npm ci'
[builder]
[builder]   Reusing cached layer /layers/paketo-buildpacks_npm/modules
===> EXPORTING
[exporter] Reusing layer 'paketo-buildpacks/node-engine:node'
[exporter] Reusing layer 'paketo-buildpacks/npm:modules'
[exporter] Adding 1/1 app layer(s)
[exporter] Reusing layer 'launcher'
[exporter] Reusing layer 'config'
[exporter] Reusing layer 'process-types'
[exporter] Adding label 'io.buildpacks.lifecycle.metadata'
[exporter] Adding label 'io.buildpacks.build.metadata'
[exporter] Adding label 'io.buildpacks.project.metadata'
[exporter] Setting default process type 'web'
[exporter] *** Images (bd9b56b816b1):
[exporter]       index.docker.io/library/myapp:latest
[exporter] Reusing cache layer 'paketo-buildpacks/node-engine:node'
Successfully built image myapp

Again run docker run -it myapp and confirm that the chalk command is still not found on the $PATH:

> myapp@ start /workspace
> chalk red bold 'Unicorns & Rainbows'

sh: 1: chalk: not found
npm ERR! code ELIFECYCLE
npm ERR! syscall spawn
npm ERR! file sh
npm ERR! errno ENOENT
npm ERR! myapp@ start: `chalk red bold 'Unicorns & Rainbows'`
npm ERR! spawn ENOENT
npm ERR!
npm ERR! Failed at the myapp@ start script.
npm ERR! This is probably not a problem with npm. There is likely additional logging output above.

npm ERR! A complete log of this run can be found in:
npm ERR!     /home/cnb/.npm/_logs/2020-09-16T17_10_52_761Z-debug.log

Run npm install --package-lock-only in the source directory. This will update the package-lock.json file.

Run pack build myapp --buildpack gcr.io/paketo-buildpacks/nodejs and see the following logs, noting that the node_modules layer is rebuilt this time:

===> DETECTING
[detector] paketo-buildpacks/node-engine 0.0.262
[detector] paketo-buildpacks/npm         0.1.80
===> ANALYZING
[analyzer] Restoring metadata for "paketo-buildpacks/node-engine:node" from app image
[analyzer] Restoring metadata for "paketo-buildpacks/npm:modules" from app image
===> RESTORING
[restorer] Restoring data for "paketo-buildpacks/node-engine:node" from cache
===> BUILDING
[builder] Node Engine Buildpack 0.0.262
[builder]   Resolving Node Engine version
[builder]     Candidate version sources (in priority order):
[builder]        -> "*"
[builder]
[builder]     Selected Node Engine version (using ): 10.22.0
[builder]
[builder]   Reusing cached layer /layers/paketo-buildpacks_node-engine/node
[builder]
[builder] NPM Buildpack 0.1.80
[builder]   Resolving installation process
[builder]     Process inputs:
[builder]       node_modules      -> "Not found"
[builder]       npm-cache         -> "Not found"
[builder]       package-lock.json -> "Found"
[builder]
[builder]     Selected NPM build process: 'npm ci'
[builder]
[builder]   Executing build process
[builder]     Running 'npm ci --unsafe-perm --cache /layers/paketo-buildpacks_npm/npm-cache'
[builder]       Completed in 2.559s
[builder]
[builder]   Configuring environment
[builder]     NPM_CONFIG_LOGLEVEL   -> "error"
[builder]     NPM_CONFIG_PRODUCTION -> "true"
[builder]     PATH                  -> "$PATH:/layers/paketo-buildpacks_npm/modules/node_modules/.bin"
===> EXPORTING
[exporter] Reusing layer 'paketo-buildpacks/node-engine:node'
[exporter] Adding layer 'paketo-buildpacks/npm:modules'
[exporter] Adding 1/1 app layer(s)
[exporter] Reusing layer 'launcher'
[exporter] Reusing layer 'config'
[exporter] Reusing layer 'process-types'
[exporter] Adding label 'io.buildpacks.lifecycle.metadata'
[exporter] Adding label 'io.buildpacks.build.metadata'
[exporter] Adding label 'io.buildpacks.project.metadata'
[exporter] Setting default process type 'web'
[exporter] *** Images (ddfb2f3a09c1):
[exporter]       index.docker.io/library/myapp:latest
[exporter] Reusing cache layer 'paketo-buildpacks/node-engine:node'
[exporter] Adding cache layer 'paketo-buildpacks/npm:npm-cache'
Successfully built image myapp

Run docker run -it myapp one last time, seeing the following output:

> myapp@ start /workspace
> chalk red bold 'Unicorns & Rainbows'

Unicorns & Rainbows

Proposal

The buildpack should fail the build if the package.json has been updated without the package-lock.json also being updated. The buildpack should detect this situation and show a reasonable error message to the user suggesting that they may need to run npm install --package-lock-only in order to update their package-lock.json file. It looks like this is at least impacts the npm ci build process, but it may also impact other build processes. We should ensure we have coverage of this case for all chosen build processes if applicable.

Replace log testing implementation with occam/matchers.ContainLines

The integration tests in this repo include a set of helpers that provide some assertions about log output: https://github.com/paketo-buildpacks/npm/blob/master/integration/init_test.go#L84-L172.

This functionality has been pulled into the ContainLines matcher in occam: https://github.com/cloudfoundry/occam/blob/master/matchers/contain_lines.go.

The parts of the integration test suite that uses these helpers should be replaced with the ContainLines matcher.

Buildpack removes existing node modules symlink

What happened?

What were you attempting to do?
Use the npm-install buildpack in my builder
What did you expect to happen?
Build into a image and have the image run successfully..
What was the actual behavior? Please provide log output, if possible.
While running my image, I got

2022/04/07 14:52:13 unlinkat /workspace/node_modules: operation not permitted

Build Configuration

What platform (pack, kpack, tekton buildpacks plugin, etc.) are you
using? Please include a version.
pack
What buildpacks are you using? Please include versions.
node-engine 0.12.3
npm-install 0.9.0
npm-run 0.9.0
Can you provide a sample app or relevant configuration (buildpack.yml,
nginx.conf, etc.)?
A simple hello world app generated with node/npm.

The issue is the setup-symlinks script that is executed at runtime deletes the node_modules folder in the appDir. The build stage sets this up as a symlink in a layer. The setup-symlinks scripts isn't run with the right permissions to delete this folder thus we fail the start the container.

NPM install fails with NPM from Node 17 with "UNABLE_TO_GET_ISSUER_CERT_LOCALLY"

What happened?

What were you attempting to do?

Test out pack building a simple NPM app with Node 17.0.1. The NPM version that comes with Node 17.0.1 is NPM 8.1.0

What did you expect to happen?

The build succeeds.

What was the actual behavior? Please provide log output, if possible.

See logs. The NPM install step of the build fails with UNABLE_TO_GET_ISSUER_CERT_LOCALLY. When I manually ran npm install with this version of NPM, it didn't work unless I ran npm set strict-ssl=false first.

We should determine if we can get NPM to work without setting strict-ssl to false. This is the only way we can get Node 17 support on the Paketo Node.js language family. This issue could be from upgrades to OpenSSL in Node 17.0.0, and a fix may be possible when we compile the artifact.

===> BUILDING
[builder] Paketo Node Engine Buildpack 1.2.3
[builder]   Resolving Node Engine version
[builder]     Candidate version sources (in priority order):
[builder]       BP_NODE_VERSION -> "17.*"
[builder]       package.json    -> "~17"
[builder]       <unknown>       -> ""
[builder]
[builder]     Selected Node Engine version (using BP_NODE_VERSION): 17.0.1
[builder]  ..........................
[builder] Paketo NPM Install Buildpack 0.4.0
[builder]   Resolving installation process
[builder]     Process inputs:
[builder]       node_modules      -> "Not found"
[builder]       npm-cache         -> "Not found"
[builder]       package-lock.json -> "Not found"
[builder]
[builder]     Selected NPM build process: 'npm install'
[builder]
[builder]   Executing build process
[builder]     Running 'npm install --unsafe-perm --cache /layers/paketo-buildpacks_npm-install/npm-cache'
[builder] npm install failed: exit status 1
[builder]     npm ERR! code UNABLE_TO_GET_ISSUER_CERT_LOCALLY
[builder]     npm ERR! errno UNABLE_TO_GET_ISSUER_CERT_LOCALLY
[builder]     npm ERR! request to https://registry.npmjs.org/leftpad failed, reason: unable to get local issuer certificate

I have also uploaded the compiled Node 17.0.1 artifact here I used in this build for reproduction purposes.

You can test this out by cloning the Node Engine buildpack, add the node 17 tarball to the buildpack directory, and add the following to the buildpack.toml:

  [[metadata.dependencies]]
    id = "node"
    name = "Node Engine"
checksum=36467b8a4e7e3bacc2f4f1709a83b0506429d1999bc461e5e363bc91d3437c09&download_url=https://nodejs.org/dist/v16.6.1/node-v16.6.1.tar.gz"
    sha256 = "a678419d58b997a9ad9a348546308e75bf5ed2c5a60176be6898aab91710d6f3"
    source = "https://nodejs.org/dist/v17.0.1/node-v17.0.1.tar.gz"
    source_sha256 = "f06242a7958b89f1bc3c7070af1ff5e477a9d3b76d2348456617f87e8f4f6988"
    stacks = ["io.buildpacks.stacks.bionic"]
    uri = "file://node-17.tgz"
    version = "17.0.1"

and also add the node-17.tgz file to the include-files section in the buildpack.toml. Package the buildpack, and build apps with this version of node-engine. You can also pack build with BP_NODE_VERSION=17.*.

Build Configuration

What platform (pack, kpack, tekton buildpacks plugin, etc.) are you
using? Please include a version.

pack 0.15.1

Checklist

I have included log output.
The log output includes an error message.
I have included steps for reproduction.

Dependabot can't resolve your Go dependency files

Dependabot can't resolve your Go dependency files.

As a result, Dependabot couldn't update your dependencies.

The error Dependabot encountered was:

verifying github.com/paketo-buildpacks/[email protected]: checksum mismatch
	downloaded: h1:wHlUTvU6ftwQt202cidSjp0ml2oXYybEP/yRHAQTct8=
	go.sum:     h1:bDixAQpv33yf91eYY/WXJtRwP3LGwwJjCiWUAHjmk3o=

SECURITY ERROR
This download does NOT match an earlier download recorded in go.sum.
The bits may have been replaced on the origin server, or an attacker may
have intercepted the download attempt.

For more information, see 'go help module-auth'.

If you think the above is an error on Dependabot's side please don't hesitate to get in touch - we'll do whatever we can to fix it.

View the update logs.

Support Jammy Jellyfish

Describe the Enhancement

As a part of paketo-buildpacks/nodejs#607, support Jammy Jellyfish in this buildpack.

Blocked

This issue is blocked on the availability of a builder-jammy-buildpackless-full builder. See paketo-buildpacks/builder-jammy-buildpackless-full#1

The buildpack already supports the wildcard stack. The changes needed are:

Remove the Bionic stack from the buildpack.toml in favour of just the wildcard stack
Add some kind of testing like Frankie did here
Needs the Jammy Buildpackless Full builder to test against

Motivation

Needed to create the Jammy Base Builder and Jammy Full Builder.

Build fails when `npm-cache` is supplied beforehand

Expected Behavior

Builds should succeed when npm-cache is provided

Current Behavior

When npm-cache is supplied before a pack build, the build fails.

Possible Solution

The problem is here. Unclear what the problem is with the fs.Move() step.

Steps to Reproduce

Using the NPM app from paketo-buildpacks/samples:

After running npm ci --cache npm-cache (as directed in the Paketo docs), the app directory looks as follows:

drwxrwxr-x  4 ubuntu ubuntu  4096 Sep 16 19:41 .
drwxrwxr-x  8 ubuntu ubuntu  4096 Aug 10 19:08 ..
-rw-rw-r--  1 ubuntu ubuntu    14 Aug 10 14:51 .gitignore
drwxrwxr-x 77 ubuntu ubuntu  4096 Sep 16 19:41 node_modules
drwxrwxr-x  3 ubuntu ubuntu  4096 Sep 16 19:41 npm-cache
-rw-rw-r--  1 ubuntu ubuntu   405 Sep 16 13:05 package.json
-rw-rw-r--  1 ubuntu ubuntu 23948 Sep 16 13:05 package-lock.json
-rw-rw-r--  1 ubuntu ubuntu   232 Aug 10 14:51 README.md
-rw-rw-r--  1 ubuntu ubuntu   447 Aug 10 14:51 server.js

Subsequently, running pack build <app-name> -b paketo-buildpacks/nodejs -B paketobuildpacks/builder-jammy-buildpackless-base produces the following build output:

===> BUILDING
[builder]
[builder] Paketo Buildpack for CA Certificates 3.4.0
[builder]   https://github.com/paketo-buildpacks/ca-certificates
[builder]   Launch Helper: Reusing cached layer
[builder] Paketo Buildpack for Node Engine 0.16.0
[builder]   Resolving Node Engine version
[builder]     Candidate version sources (in priority order):
[builder]                 -> ""
[builder]       <unknown> -> ""
[builder]
[builder]     Selected Node Engine version (using ): 16.17.0
[builder]
[builder]   Reusing cached layer /layers/paketo-buildpacks_node-engine/node
[builder]
[builder] Paketo Buildpack for NPM Install 0.10.5
[builder]   Resolving installation process
[builder] failed to move: mkdir /layers/paketo-buildpacks_npm-install/npm-cache/npm-cache: no such file or directory
[builder] ERROR: failed to build: exit status 1
ERROR: failed to build: executing lifecycle. This may be the result of using an untrusted builder: failed with status code: 51

Motivations

Dependabot wasn't able to update github.com/cloudfoundry/packit

The module path github.com/cloudfoundry/packit found in your /go.mod doesn't match the actual path github.com/paketo-buildpacks/packit found in the dependency's go.mod.

Updating the module path in your go.mod to github.com/paketo-buildpacks/packit should resolve this issue.

View the update logs.

Configure `NPM_CONFIG_GLOBALCONFIG`

Implement paketo-buildpacks/nodejs#396 in the NPM Install buildpack.

Implementation Notes

The implementation should set the NPM_CONFIG_GLOBALCONFIG environment variable at build-time for use within the npm install command, and for subsequent buildpacks that rely on the node modules (such as the Node Run Script buildpack).

What do you think about doing npm install only?

Hi team!
Thank you for your commitment to cnb.
by the way, I think, we not always need npm start.
For example, I usualy make architecture with javascript for frontend and php for backend.
In this case use the web server is httpd or nginx, that's why I can't need npm start

do you have a plan for npm only use npm install?

Please confirm where necessary:

I have included a log output
My log includes an error message
I have included steps for reproduction

Cannot upgrade from 0.0.92 to 0.1.1

What version of the buildpack you are using?
0.1.1

If you were attempting to accomplish a task, what was it you were attempting to do?
Dependabot tried to upgrade npm-cnb from 0.0.92 to 0.1.1 for our custom riff builder, but the CI failed at dependency resolution.

What did you expect to happen?
I would expect the build to carry on.

What was the actual behavior?
As you can from the job logs:

-> unzip /home/runner/go/pkg/mod/cache/download/github.com/cloudfoundry/npm-cnb/@v/v0.1.1.zip: malformed file path "integration/testdata/vendored/node_modules/figlet/fonts/Patorjk's Cheese.flf": invalid char '\''
##[error]Makefile:17: recipe for target 'builder.toml' failed

NPM Buildpack should only run "npm install"

As per the Node.js re-architecture RFC, once paketo-buildpacks/nodejs#212 is implemented, we should rename this buildpack to Paketo NPM Install Buildpack and update the buildpack to only run npm install. After this is complete, Language family ordering will look like:

[[order]]

  [[order.group]]
    id = "paketo-buildpacks/node-engine"

  [[order.group]]
    id = "paketo-buildpacks/yarn"

  [[order.group]]
    id = "paketo-buildpacks/yarn-install"

  [[order.group]]
    id = "paketo-buildpacks/tini"

  [[order.group]]
    id = "paketo-buildpacks/yarn-start"

[[order]]

  [[order.group]]
    id = "paketo-buildpacks/node-engine"

  [[order.group]]
    id = "paketo-buildpacks/npm-install"

  [[order.group]]
    id = "paketo-buildpacks/tini"

  [[order.group]]
    id = "paketo-buildpacks/npm-start"

[[order]]

  [[order.group]]
    id = "paketo-buildpacks/node-engine"

  [[order.group]]
    id = "paketo-buildpacks/node-start"

Update module from cloudfoundry -> paketo-buildpacks

The current go.mod file references a github.com/cloudfoundry repo. Now that this repo lives in the paketo-buildpacks org, we should update the module name and the internal import statements in this codebase.

Node modules are not installed

What happened?

What were you attempting to do?

Build and run a simple NodeJS application that uses npm

What did you expect to happen?

npm install was run and all node modules were installed

What was the actual behavior? Please provide log output, if possible.

No node modules were installed. It looks like if no start script is found in the package.json file then npm-install buildpack is not included.

Buildpacks included are

3 of 8 buildpacks participating
paketo-buildpacks/ca-certificates 3.0.3
paketo-buildpacks/node-engine     0.12.1
paketo-buildpacks/node-start      0.7.1

The run logs when starting the container is

node:internal/modules/cjs/loader:936
throw err;
^
Error: Cannot find module 'fastify'
Require stack:
- /workspace/index.js
at Function.Module._resolveFilename (node:internal/modules/cjs/loader:933:15)
at Function.Module._load (node:internal/modules/cjs/loader:778:27)
at Module.require (node:internal/modules/cjs/loader:1005:19)
at require (node:internal/modules/cjs/helpers:102:18)
at Object.<anonymous> (/workspace/index.js:1:17)
at Module._compile (node:internal/modules/cjs/loader:1103:14)
at Object.Module._extensions..js (node:internal/modules/cjs/loader:1155:10)
at Module.load (node:internal/modules/cjs/loader:981:32)
at Function.Module._load (node:internal/modules/cjs/loader:822:12)
at Function.executeUserEntryPoint [as runMain] (node:internal/modules/run_main:77:12) {
code: 'MODULE_NOT_FOUND',
requireStack: [ '/workspace/index.js' ]
}

If a start script is include then the buildpacks participating are

paketo-buildpacks/ca-certificates 3.0.3
paketo-buildpacks/node-engine     0.12.1
paketo-buildpacks/npm-install     0.8.0
paketo-buildpacks/node-module-bom 0.2.2
paketo-buildpacks/npm-start       0.8.0

and node modules are installed

Build Configuration

What platform (pack, kpack, tekton buildpacks plugin, etc.) are you
using? Please include a version.

pack version 0.24.0+git-79a40b7.build-3148

What buildpacks are you using? Please include versions.

paketo-buildpacks/ca-certificates 3.0.3
paketo-buildpacks/node-engine     0.12.1
paketo-buildpacks/node-start      0.7.1

What builder are you using? If custom, can you provide the output from pack inspect-builder <builder>?

paketobuildpacks/builder:full

Can you provide a sample app or relevant configuration (buildpack.yml,
nginx.conf, etc.)?

I've created a sample app at https://github.com/coffee-cup/paketo-npm-install-example

No way to request NPM without package.json

Currently there is no way to request the npm buildpack contribute without having a package.json file in your application. This is problematic because there are uses cases for requiring npm at build time, without you having an npm-based application. One such example is riff which requires npm in order to install an invoker, but then does not use npm to run the application.

The buildpack should honor any explicit request for node_modules as indication that it should contribute, regardless of the state of the application.

When using project.toml to specify included source files I get the error "unlinkat /workspace/node_modules/end-of-stream/package.json: permission denied"

What happened?

I have added a project.toml file to my project that looks like this:

[build]
include = [
    "src",
    "package.json",
    "package-lock.json",
    "nest-cli.json",
    "tsconfig.*json",
]

Now when I run

pack build buildpack-nodejs-poc --builder paketobuildpacks/builder:base

my pack build fails with this error message:

Paketo Node Engine Buildpack 0.1.4
  Resolving Node Engine version
    Candidate version sources (in priority order):
                -> ""
      <unknown> -> "*"

    Selected Node Engine version (using ): 14.15.1

  Reusing cached layer /layers/paketo-buildpacks_node-engine/node

Paketo NPM Install Buildpack 0.2.3
  Resolving installation process
    Process inputs:
      node_modules      -> "Found"
      npm-cache         -> "Not found"
      package-lock.json -> "Found"

    Selected NPM build process: 'npm rebuild'

  Executing build process
unlinkat /workspace/node_modules/end-of-stream/package.json: permission denied
ERROR: failed to build: exit status 1
ERROR: failed to build: executing lifecycle: failed with status code: 145

You can easily reproduce the error with this GitHub repository: https://github.com/bernhardvollnhofer/buildpack-nodejs-poc

What were you attempting to do?
I attempted to only include some source directories in my build.
What did you expect to happen?
I expected my build to finish successfully.
What was the actual behavior? Please provide log output, if possible.

unlinkat /workspace/node_modules/end-of-stream/package.json: permission denied
ERROR: failed to build: exit status 1
ERROR: failed to build: executing lifecycle: failed with status code: 145

Build Configuration

Please provide some details about your build configuration.

What platform (pack, kpack, tekton buildpacks plugin, etc.) are you using? Please include a version.

$ pack version
0.15.1+git-79adc30.build-1660

What buildpacks are you using? Please include versions.
I use the auto-detected buildpacks.
What builder are you using? If custom, can you provide the output from pack inspect-builder <builder>?
I use paketobuildpacks/builder:base.
Can you provide a sample app or relevant configuration (buildpack.yml,
nginx.conf, etc.)?
Here is a GitHub repo where the issue can be reproduced: https://github.com/bernhardvollnhofer/buildpack-nodejs-poc

Checklist

Please confirm the following:

I have included log output.
The log output includes an error message.
I have included steps for reproduction.

paketo-buildpacks / npm-install Goto Github PK

npm-install's Introduction

Paketo Buildpack for NPM Install

Integration

Usage

Specifying a project path

Run Tests

Stack support

npm-install's People

Contributors

Stargazers

Watchers

Forkers

npm-install's Issues

Acceptance

Blocking

Reproducing the issue

Proposed implementation

Expected Behavior

Current Behavior

Possible Solution

Steps to Reproduce

Motivations

Expected Behavior

Current Behavior

Possible Solution

Steps to Reproduce

Motivations

What happened?

Reproduction Steps

Checklist

Acceptance

Expected Behavior

Current Behavior

Possible Solution

Steps to Reproduce

Motivations

Expected Behavior

Current Behavior

Possible Solution

Steps to Reproduce

Motivations

What happened?

Build Configuration

Checklist

What happened?

Reproduction Steps:

Checklist

Expected Behavior

Current Behavior

Possible Solution

Steps to Reproduce

Motivations

What happened?

Build Configuration

Checklist

Replication steps

Proposal

What happened?

Build Configuration

What happened?

Build Configuration

Checklist

Describe the Enhancement

Blocked

Motivation

Expected Behavior

Current Behavior

Possible Solution

Steps to Reproduce

Motivations

Implementation Notes

What happened?

Build Configuration

What happened?

Build Configuration

Checklist

Recommend Projects

Recommend Topics

Recommend Org