npm install in postinst fails when having native library dependency

[janoskk]

I'm about to create a debian package for wetty that has a native library dependency. This needs to be recompiled with node-gyp but it has a known installation issue when calling npm install as root. The issue with a solution is described here: nodejs/node-gyp#454 or nodejs/node-gyp#1383

To fix the issue the --unsafe-perm option should be used.

In detail

I created a debian package with the following:

node-deb --install-strategy npm-install  -- app.js bin public/

When I tried to install, I got the following error (aborted manually due to infinite loop)

$ sudo dpkg -i wetty_0.2.0_all.deb
...
gyp WARN EACCES attempting to reinstall using temporary dev dir "/usr/share/wetty/app/node_modules/pty.js/.node-gyp"
gyp WARN EACCES user "root" does not have permission to access the dev dir "/usr/share/wetty/app/node_modules/pty.js/.node-gyp/8.11.2"
gyp WARN EACCES attempting to reinstall using temporary dev dir "/usr/share/wetty/app/node_modules/pty.js/.node-gyp"
gyp WARN EACCES user "root" does not have permission to access the dev dir "/usr/share/wetty/app/node_modules/pty.js/.node-gyp/8.11.2"
gyp WARN EACCES attempting to reinstall using temporary dev dir "/usr/share/wetty/app/node_modules/pty.js/.node-gyp"
^C
dpkg: error processing package wetty (--install):
 subprocess installed post-installation script was interrupted
Processing triggers for systemd (232-25+deb9u2) ...
Errors were encountered while processing:
 wetty

After adding the --unsafe-perm option to npm install (at the postinst template), I installed the package successfully:

$ sudo dpkg -i wetty_0.2.0_all.deb
sudo: unable to resolve host stretch: Connection timed out
(Reading database ... 60114 files and directories currently installed.)
Preparing to unpack wetty_0.2.0_all.deb ...
Synchronizing state of wetty.service with SysV service script with /lib/systemd/systemd-sysv-install.
Executing: /lib/systemd/systemd-sysv-install disable wetty
Unpacking wetty (0.2.0) over (0.2.0) ...
Setting up wetty (0.2.0) ...
Installing dependenencies from NPM

> [email protected] install /usr/share/wetty/app/node_modules/pty.js
> node-gyp rebuild

make: Entering directory '/usr/share/wetty/app/node_modules/pty.js/build'
  CXX(target) Release/obj.target/pty/src/unix/pty.o
  SOLINK_MODULE(target) Release/obj.target/pty.node
  COPY Release/pty.node
make: Leaving directory '/usr/share/wetty/app/node_modules/pty.js/build'
added 201 packages in 6.175s
Synchronizing state of wetty.service with SysV service script with /lib/systemd/systemd-sysv-install.
Executing: /lib/systemd/systemd-sysv-install enable wetty
Processing triggers for systemd (232-25+deb9u2) ...

[heartsucker]

Just for clarification, does this mean that npm has a bug where directories owned by root throw this error? And is there a work around that doesn't involve using --unsafe-perm since that warning may become useful again in the future?

[janoskk]

Running npm as root is unusual. See the documentation https://docs.npmjs.com/misc/scripts#user :

If npm was invoked with root privileges, then it will change the uid to the user account or uid specified by the user config, which defaults to nobody. Set the unsafe-perm flag to run scripts with root privileges.

[heartsucker]

Closed by #89