Different run-image and build-image users causing runtime failure about npm-install HOT 2 CLOSED

I can confirm that this line in the buildpack, executed at runtime (it's actually the setup-symlinks binary that runs, but you get the point), causes a failure in environments where the run image user does not have the same permissions as the build image user.

I can also see in RFC-0045 the following text

This RFC recommends that we identify buildpacks that making runtime modifications to the application directory or buildpack layers and modify them to instead use a temporary directory - or have them make these files group writable instead. All the current Paketo stacks' build-time and run-time users belong to a unique group so changing the file permissions to be group writable should have no additional security implications for users using the Paketo stacks.

The platform specification states, regarding build images.

The platform MUST ensure that:

The image config's User field is set to a non-root user with a writable home directory.
The image config's Env field has the environment variable CNB_STACK_ID set to the stack ID.
The image config's Env field has the environment variable CNB_USER_ID set to the user †UID/‡SID of the user specified in the User field.
The image config's Env field has the environment variable CNB_GROUP_ID set to the primary group †GID/‡SID of the user specified in the User field.

And regarding run images, it says:

The platform SHOULD ensure that:

The image config's User field is set to a user with a DIFFERENT user †UID/‡SID as the build image.

Which could easily imply that files and directories in /layers/paketo-buildpacks_npm-install are not writable by the run image user.

This problem renders Paketo's recent Node.js buildpack release unusable on OpenShift 4.10 for developers, due to the platform's security constraints on run images.

from npm-install.

Thanks for looking into this @thitch97 and @ryanmoran ! Could we create a new release for the buildpack now? :)

from npm-install.