setup.sh yarn install fails - "Commit hash required"

GFJHogue commented 3 years ago

JBrowse version: 1.16.6 & 1.16.10
Operating system: Ubuntu 20.04.1 & in Docker

Relevant part of setup.log

yarn install v1.22.4
warning package-lock.json found. Your project contains lock files generated by tools other than Yarn. It is advised not to mix package managers in order to avoid resolution inconsistencies caused by unsynchronized lock files. To clear this warning, remove package-lock.json.
[1/4] Resolving packages...
[2/4] Fetching packages...
error An unexpected error occurred: "Commit hash required".

Full setup.sh output at line 356 and onward https://travis-ci.com/github/LincolnSteinLab/gdc-viewer/builds/198342967

Noticed this when my Travis tests started failing.

Testing locally, I was able to reproduce this issue by running npm install yarn followed by node_modules/.bin/yarn install as per https://github.com/GMOD/jbrowse/blob/b8324df0033796b6d502696dc65c9ff888aae2f3/setup.sh#L133

However installing yarn "globally" with npm i -g yarn and running yarn install (with same node/yarn versions) works fine for me, so that's my workaround for now.

Since I was able to reproduce with JBrowse 1.16.6 & 1.16.10, I'm guessing a hash changed for something in yarn.lock.

cmdcolin commented 3 years ago

There is an issue thread on the yarn repo where it says this can be due to

old version/upgrade yarn/mystery thing
replace git+https to git+ssh on packages that install direct from github. We install one package direct from github, jszlib, in our package.json

https://github.com/yarnpkg/yarn/issues/2976

I can't reproduce this locally so hard to say. Maybe we leave this open until we can find a proper fix

cmdcolin commented 3 years ago

Also, we can't replace git+https to git+ssh because we get issue reports saying peoples firewalls block ssh

A real ideal would be replacing this old jszlib dependency but that will take a little work, probably replace with pako

cmdcolin commented 3 years ago

Also, it is unclear whether this is the jszlib thing or just mystery thing, that is just the only dependency that explicitly points to a github repo but there are other things that could be using hashes in the dependency tree

cmdcolin commented 3 years ago

I think both @hans-vg and @GFJHogue confirmed this fixed their local workflow (yay)

closing for now

GMOD / jbrowse

setup.sh yarn install fails - "Commit hash required" #1555