Bitwarden CLI doesn't build anymore due to retracted `node-argon2` dependency

sanmai-NL commented 1 year ago

Steps To Reproduce

See https://github.com/ranisalt/node-argon2/releases for an explanation about some CVE.

$ podman run --rm -it alpine:edge /bin/sh
# apk add npm argon2-libs python3
# npm \
>   install \
>   --global \
>   --quiet \
>   @bitwarden/cli
npm WARN deprecated @babel/plugin-proposal-export-namespace-from@7.18.9: This proposal has been merged to the ECMAScript standard and thus this plugin is no longer maintained. Please use @babel/plugin-transform-export-namespace-from instead.
npm ERR! code 1
npm ERR! path /usr/local/lib/node_modules/@bitwarden/cli/node_modules/argon2
npm ERR! command failed
npm ERR! command sh -c node-pre-gyp install --fallback-to-build
npm ERR! Failed to execute '/usr/bin/node /usr/lib/node_modules/npm/node_modules/node-gyp/bin/node-gyp.js build --fallback-to-build --module=/usr/local/lib/node_modules/@bitwarden/cli/node_modules/argon2/lib/binding/napi-v3/argon2.node --module_name=argon2 --module_path=/usr/local/lib/node_modules/@bitwarden/cli/node_modules/argon2/lib/binding/napi-v3 --napi_version=9 --node_abi_napi=napi --napi_build_version=3 --node_napi_label=napi-v3' (1)
npm ERR! node-pre-gyp ERR! install response status 404 Not Found on https://github.com/ranisalt/node-argon2/releases/download/v0.31.0/argon2-v0.31.0-napi-v3-linux-arm64-musl.tar.gz 
npm ERR! node-pre-gyp WARN Pre-built binaries not installable for argon2@0.31.0 and node@20.8.0 (node-v115 ABI, musl) (falling back to source compile with node-gyp) 
npm ERR! node-pre-gyp WARN Hit error response status 404 Not Found on https://github.com/ranisalt/node-argon2/releases/download/v0.31.0/argon2-v0.31.0-napi-v3-linux-arm64-musl.tar.gz 
npm ERR! gyp ERR! build error 
npm ERR! gyp ERR! stack Error: not found: make
npm ERR! gyp ERR! stack     at getNotFoundError (/usr/lib/node_modules/npm/node_modules/node-gyp/node_modules/which/which.js:10:17)
npm ERR! gyp ERR! stack     at /usr/lib/node_modules/npm/node_modules/node-gyp/node_modules/which/which.js:57:18
npm ERR! gyp ERR! stack     at new Promise (<anonymous>)
npm ERR! gyp ERR! stack     at step (/usr/lib/node_modules/npm/node_modules/node-gyp/node_modules/which/which.js:54:21)
npm ERR! gyp ERR! stack     at /usr/lib/node_modules/npm/node_modules/node-gyp/node_modules/which/which.js:71:22
npm ERR! gyp ERR! stack     at new Promise (<anonymous>)
npm ERR! gyp ERR! stack     at subStep (/usr/lib/node_modules/npm/node_modules/node-gyp/node_modules/which/which.js:69:33)
npm ERR! gyp ERR! stack     at /usr/lib/node_modules/npm/node_modules/node-gyp/node_modules/which/which.js:80:22
npm ERR! gyp ERR! stack     at /usr/lib/node_modules/npm/node_modules/isexe/index.js:42:5
npm ERR! gyp ERR! stack     at /usr/lib/node_modules/npm/node_modules/isexe/mode.js:8:5
npm ERR! gyp ERR! System Linux 6.4.15-200.fc38.aarch64
npm ERR! gyp ERR! command "/usr/bin/node" "/usr/lib/node_modules/npm/node_modules/node-gyp/bin/node-gyp.js" "build" "--fallback-to-build" "--module=/usr/local/lib/node_modules/@bitwarden/cli/node_modules/argon2/lib/binding/napi-v3/argon2.node" "--module_name=argon2" "--module_path=/usr/local/lib/node_modules/@bitwarden/cli/node_modules/argon2/lib/binding/napi-v3" "--napi_version=9" "--node_abi_napi=napi" "--napi_build_version=3" "--node_napi_label=napi-v3"
npm ERR! gyp ERR! cwd /usr/local/lib/node_modules/@bitwarden/cli/node_modules/argon2
npm ERR! gyp ERR! node -v v20.8.0
npm ERR! gyp ERR! node-gyp -v v9.4.0
npm ERR! gyp ERR! not ok 
npm ERR! node-pre-gyp ERR! build error 
npm ERR! node-pre-gyp ERR! stack Error: Failed to execute '/usr/bin/node /usr/lib/node_modules/npm/node_modules/node-gyp/bin/node-gyp.js build --fallback-to-build --module=/usr/local/lib/node_modules/@bitwarden/cli/node_modules/argon2/lib/binding/napi-v3/argon2.node --module_name=argon2 --module_path=/usr/local/lib/node_modules/@bitwarden/cli/node_modules/argon2/lib/binding/napi-v3 --napi_version=9 --node_abi_napi=napi --napi_build_version=3 --node_napi_label=napi-v3' (1)
npm ERR! node-pre-gyp ERR! stack     at ChildProcess.<anonymous> (/usr/local/lib/node_modules/@bitwarden/cli/node_modules/@mapbox/node-pre-gyp/lib/util/compile.js:89:23)
npm ERR! node-pre-gyp ERR! stack     at ChildProcess.emit (node:events:514:28)
npm ERR! node-pre-gyp ERR! stack     at maybeClose (node:internal/child_process:1105:16)
npm ERR! node-pre-gyp ERR! stack     at ChildProcess._handle.onexit (node:internal/child_process:305:5)
npm ERR! node-pre-gyp ERR! System Linux 6.4.15-200.fc38.aarch64
npm ERR! node-pre-gyp ERR! command "/usr/bin/node" "/usr/local/lib/node_modules/@bitwarden/cli/node_modules/.bin/node-pre-gyp" "install" "--fallback-to-build"
npm ERR! node-pre-gyp ERR! cwd /usr/local/lib/node_modules/@bitwarden/cli/node_modules/argon2
npm ERR! node-pre-gyp ERR! node -v v20.8.0
npm ERR! node-pre-gyp ERR! node-pre-gyp -v v1.0.11
npm ERR! node-pre-gyp ERR! not ok

npm ERR! A complete log of this run can be found in: /root/.npm/_logs/2023-09-29T15_25_33_468Z-debug-0.log

Expected Result

Build success.

Actual Result

Build failure.

Screenshots or Videos

No response

Additional Context

No response

Operating System

Linux

Operating System Version

Alpine Linux edge

Shell

Bash

Build Version

None yet

Issue Tracking Info

[X] I understand that work is tracked outside of Github. A PR will be linked to this issue should one be opened to address it, but Bitwarden doesn't use fields like "assigned", "milestone", or "project" to track progress.

Greenderella commented 1 year ago

Hi there,

I am unable to reproduce this issue, it has been escalated for further investigation. If you have more information that can help us, please add it below.

Thanks!

sanmai-NL commented 1 year ago

Did you test under Alpine Linux and the same CPU ISA?

canutoalex commented 1 year ago

I'm having the same issue, trying to install the CLI on a MacBook with M2 Pro.

npm ERR! code 1
npm ERR! path /Users/canutoa/Library/Application Support/fnm/node-versions/v18.18.2/installation/lib/node_modules/@bitwarden/cli/node_modules/argon2
npm ERR! command failed
npm ERR! command sh -c node-pre-gyp install --fallback-to-build
npm ERR! CC(target) Release/obj.target/libargon2/argon2/src/ref.o
npm ERR!   CC(target) Release/obj.target/libargon2/argon2/src/argon2.o
npm ERR!   CC(target) Release/obj.target/libargon2/argon2/src/core.o
npm ERR!   CC(target) Release/obj.target/libargon2/argon2/src/blake2/blake2b.o
npm ERR!   CC(target) Release/obj.target/libargon2/argon2/src/thread.o
npm ERR!   CC(target) Release/obj.target/libargon2/argon2/src/encoding.o
npm ERR!   LIBTOOL-STATIC Release/argon2.a
npm ERR!   CXX(target) Release/obj.target/argon2/argon2_node.o
npm ERR! Failed to execute '/Users/canutoa/Library/Application Support/fnm/node-versions/v18.18.2/installation/bin/node /Users/canutoa/Library/Application Support/fnm/node-versions/v18.18.2/installation/lib/node_modules/npm/node_modules/node-gyp/bin/node-gyp.js build --fallback-to-build --module=/Users/canutoa/Library/Application Support/fnm/node-versions/v18.18.2/installation/lib/node_modules/@bitwarden/cli/node_modules/argon2/lib/binding/napi-v3/argon2.node --module_name=argon2 --module_path=/Users/canutoa/Library/Application Support/fnm/node-versions/v18.18.2/installation/lib/node_modules/@bitwarden/cli/node_modules/argon2/lib/binding/napi-v3 --napi_version=9 --node_abi_napi=napi --napi_build_version=3 --node_napi_label=napi-v3' (1)

joryirving commented 10 months ago

I'm having similar issues trying to build an arm64 docker image: https://github.com/LilDrunkenSmurf/containers/actions/runs/7494738015/job/20403325081#step:11:334

https://github.com/LilDrunkenSmurf/containers/blob/79f4612aa5ec16aca49e6c4e61f593dba14f3eec/apps/bitwarden-cli/Dockerfile https://github.com/LilDrunkenSmurf/containers/blob/79f4612aa5ec16aca49e6c4e61f593dba14f3eec/apps/bitwarden-cli/metadata.yaml

The identical amd64 image works: https://github.com/LilDrunkenSmurf/containers/actions/runs/7494738015/job/20403324822#step:11:212

#9 37.57 npm WARN deprecated @babel/plugin-proposal-export-namespace-from@7.18.9: This proposal has been merged to the ECMAScript standard and thus this plugin is no longer maintained. Please use @babel/plugin-transform-export-namespace-from instead.
#9 38.04 npm WARN deprecated @koa/router@12.0.0: **IMPORTANT 10x+ PERFORMANCE UPGRADE**: Please upgrade to v12.0.1+ as we have fixed an issue with debuglog causing 10x slower router benchmark performance, see https://github.com/koajs/router/pull/173
#9 67.94 npm ERR! code 1
#9 67.94 npm ERR! path /usr/local/lib/node_modules/@bitwarden/cli/node_modules/argon2
#9 67.95 npm ERR! command failed
#9 67.95 npm ERR! command sh -c node-pre-gyp install --fallback-to-build
#9 67.95 npm ERR! Failed to execute '/usr/bin/node /usr/lib/node_modules/npm/node_modules/node-gyp/bin/node-gyp.js build --fallback-to-build --module=/usr/local/lib/node_modules/@bitwarden/cli/node_modules/argon2/lib/binding/napi-v3/argon2.node --module_name=argon2 --module_path=/usr/local/lib/node_modules/@bitwarden/cli/node_modules/argon2/lib/binding/napi-v3 --napi_version=9 --node_abi_napi=napi --napi_build_version=3 --node_napi_label=napi-v3' (1)
#9 67.95 npm ERR! node-pre-gyp info it worked if it ends with ok
#9 67.95 npm ERR! node-pre-gyp info using node-pre-gyp@1.0.11
#9 67.96 npm ERR! node-pre-gyp info using node@21.4.0 | linux | arm64
#9 67.96 npm ERR! (node:35) [DEP0040] DeprecationWarning: The `punycode` module is deprecated. Please use a userland alternative instead.
#9 67.96 npm ERR! (Use `node --trace-deprecation ...` to show where the warning was created)
#9 67.96 npm ERR! node-pre-gyp info check checked for "/usr/local/lib/node_modules/@bitwarden/cli/node_modules/argon2/lib/binding/napi-v3/argon2.node" (not found)
#9 67.96 npm ERR! node-pre-gyp http GET https://github.com/ranisalt/node-argon2/releases/download/v0.31.0/argon2-v0.31.0-napi-v3-linux-arm64-musl.tar.gz
#9 67.96 npm ERR! node-pre-gyp ERR! install response status 404 Not Found on https://github.com/ranisalt/node-argon2/releases/download/v0.31.0/argon2-v0.31.0-napi-v3-linux-arm64-musl.tar.gz 
#9 67.96 npm ERR! node-pre-gyp WARN Pre-built binaries not installable for argon2@0.31.0 and node@21.4.0 (node-v120 ABI, musl) (falling back to source compile with node-gyp) 
#9 67.96 npm ERR! node-pre-gyp WARN Hit error response status 404 Not Found on https://github.com/ranisalt/node-argon2/releases/download/v0.31.0/argon2-v0.31.0-napi-v3-linux-arm64-musl.tar.gz 
#9 67.96 npm ERR! gyp info it worked if it ends with ok
#9 67.96 npm ERR! gyp info using node-gyp@10.0.1
#9 67.96 npm ERR! gyp info using node@21.4.0 | linux | arm64
#9 67.96 npm ERR! gyp info ok 
#9 67.96 npm ERR! gyp info it worked if it ends with ok
#9 67.96 npm ERR! gyp info using node-gyp@10.0.1
#9 67.96 npm ERR! gyp info using node@21.4.0 | linux | arm64
#9 67.96 npm ERR! gyp info find Python using Python version 3.11.6 found at "/usr/bin/python3"
#9 67.96 npm ERR! gyp http GET https://nodejs.org/download/release/v21.4.0/node-v21.4.0-headers.tar.gz
#9 67.96 npm ERR! gyp http 200 https://nodejs.org/download/release/v21.4.0/node-v21.4.0-headers.tar.gz
#9 67.96 npm ERR! gyp http GET https://nodejs.org/download/release/v21.4.0/SHASUMS256.txt
#9 67.96 npm ERR! gyp http 200 https://nodejs.org/download/release/v21.4.0/SHASUMS256.txt
#9 67.96 npm ERR! gyp info spawn /usr/bin/python3
#9 67.96 npm ERR! gyp info spawn args [
#9 67.96 npm ERR! gyp info spawn args '/usr/lib/node_modules/npm/node_modules/node-gyp/gyp/gyp_main.py',
#9 67.96 npm ERR! gyp info spawn args 'binding.gyp',
#9 67.96 npm ERR! gyp info spawn args '-f',
#9 67.96 npm ERR! gyp info spawn args 'make',
#9 67.96 npm ERR! gyp info spawn args '-I',
#9 67.97 npm ERR! gyp info spawn args '/usr/local/lib/node_modules/@bitwarden/cli/node_modules/argon2/build/config.gypi',
#9 67.97 npm ERR! gyp info spawn args '-I',
#9 67.97 npm ERR! gyp info spawn args '/usr/lib/node_modules/npm/node_modules/node-gyp/addon.gypi',
#9 67.97 npm ERR! gyp info spawn args '-I',
#9 67.97 npm ERR! gyp info spawn args '/root/.cache/node-gyp/21.4.0/include/node/common.gypi',
#9 67.97 npm ERR! gyp info spawn args '-Dlibrary=shared_library',
#9 67.97 npm ERR! gyp info spawn args '-Dvisibility=default',
#9 67.97 npm ERR! gyp info spawn args '-Dnode_root_dir=/root/.cache/node-gyp/21.4.0',
#9 67.97 npm ERR! gyp info spawn args '-Dnode_gyp_dir=/usr/lib/node_modules/npm/node_modules/node-gyp',
#9 67.97 npm ERR! gyp info spawn args '-Dnode_lib_file=/root/.cache/node-gyp/21.4.0/<(target_arch)/node.lib',
#9 67.97 npm ERR! gyp info spawn args '-Dmodule_root_dir=/usr/local/lib/node_modules/@bitwarden/cli/node_modules/argon2',
#9 67.97 npm ERR! gyp info spawn args '-Dnode_engine=v8',
#9 67.97 npm ERR! gyp info spawn args '--depth=.',
#9 67.97 npm ERR! gyp info spawn args '--no-parallel',
#9 67.97 npm ERR! gyp info spawn args '--generator-output',
#9 67.97 npm ERR! gyp info spawn args 'build',
#9 67.97 npm ERR! gyp info spawn args '-Goutput_dir=.'
#9 67.97 npm ERR! gyp info spawn args ]
#9 67.97 npm ERR! gyp info ok 
#9 67.97 npm ERR! gyp info it worked if it ends with ok
#9 67.97 npm ERR! gyp info using node-gyp@10.0.1
#9 67.97 npm ERR! gyp info using node@21.4.0 | linux | arm64
#9 67.97 npm ERR! gyp ERR! build error 
#9 67.97 npm ERR! gyp ERR! stack Error: not found: make
#9 67.97 npm ERR! gyp ERR! stack at getNotFoundError (/usr/lib/node_modules/npm/node_modules/which/lib/index.js:16:17)
#9 67.97 npm ERR! gyp ERR! stack at which (/usr/lib/node_modules/npm/node_modules/which/lib/index.js:77:9)
#9 67.97 npm ERR! gyp ERR! stack at async doWhich (/usr/lib/node_modules/npm/node_modules/node-gyp/lib/build.js:112:22)
#9 67.97 npm ERR! gyp ERR! stack at async loadConfigGypi (/usr/lib/node_modules/npm/node_modules/node-gyp/lib/build.js:77:7)
#9 67.97 npm ERR! gyp ERR! stack at async build (/usr/lib/node_modules/npm/node_modules/node-gyp/lib/build.js:35:3)
#9 67.98 npm ERR! gyp ERR! stack at async run (/usr/lib/node_modules/npm/node_modules/node-gyp/bin/node-gyp.js:81:18)
#9 67.98 npm ERR! gyp ERR! System Linux 6.2.0-1018-azure
#9 67.98 npm ERR! gyp ERR! command "/usr/bin/node" "/usr/lib/node_modules/npm/node_modules/node-gyp/bin/node-gyp.js" "build" "--fallback-to-build" "--module=/usr/local/lib/node_modules/@bitwarden/cli/node_modules/argon2/lib/binding/napi-v3/argon2.node" "--module_name=argon2" "--module_path=/usr/local/lib/node_modules/@bitwarden/cli/node_modules/argon2/lib/binding/napi-v3" "--napi_version=9" "--node_abi_napi=napi" "--napi_build_version=3" "--node_napi_label=napi-v3"
#9 67.98 npm ERR! gyp ERR! cwd /usr/local/lib/node_modules/@bitwarden/cli/node_modules/argon2
#9 67.98 npm ERR! gyp ERR! node -v v21.4.0
#9 67.98 npm ERR! gyp ERR! node-gyp -v v10.0.1
#9 67.98 npm ERR! gyp ERR! not ok 
#9 67.98 npm ERR! node-pre-gyp ERR! build error 
#9 67.98 npm ERR! node-pre-gyp ERR! stack Error: Failed to execute '/usr/bin/node /usr/lib/node_modules/npm/node_modules/node-gyp/bin/node-gyp.js build --fallback-to-build --module=/usr/local/lib/node_modules/@bitwarden/cli/node_modules/argon2/lib/binding/napi-v3/argon2.node --module_name=argon2 --module_path=/usr/local/lib/node_modules/@bitwarden/cli/node_modules/argon2/lib/binding/napi-v3 --napi_version=9 --node_abi_napi=napi --napi_build_version=3 --node_napi_label=napi-v3' (1)
#9 67.98 npm ERR! node-pre-gyp ERR! stack     at ChildProcess.<anonymous> (/usr/local/lib/node_modules/@bitwarden/cli/node_modules/@mapbox/node-pre-gyp/lib/util/compile.js:89:23)
#9 67.98 npm ERR! node-pre-gyp ERR! stack     at ChildProcess.emit (node:events:519:28)
#9 67.98 npm ERR! node-pre-gyp ERR! stack     at maybeClose (node:internal/child_process:1105:16)
#9 67.98 npm ERR! node-pre-gyp ERR! stack     at ChildProcess._handle.onexit (node:internal/child_process:[305](https://github.com/LilDrunkenSmurf/containers/actions/runs/7494738015/job/20403325081#step:11:310):5)
#9 67.98 npm ERR! node-pre-gyp ERR! System Linux 6.2.0-1018-azure
#9 67.98 npm ERR! node-pre-gyp ERR! command "/usr/bin/node" "/usr/local/lib/node_modules/@bitwarden/cli/node_modules/.bin/node-pre-gyp" "install" "--fallback-to-build"
#9 67.98 npm ERR! node-pre-gyp ERR! cwd /usr/local/lib/node_modules/@bitwarden/cli/node_modules/argon2
#9 67.98 npm ERR! node-pre-gyp ERR! node -v v21.4.0
#9 67.98 npm ERR! node-pre-gyp ERR! node-pre-gyp -v v1.0.11
#9 67.98 npm ERR! node-pre-gyp ERR! not ok
#9 68.01 
#9 68.01 npm ERR! A complete log of this run can be found in: /root/.npm/_logs/2024-01-11T21_28_24_194Z-debug-0.log
#9 ERROR: process "/dev/.buildkit_qemu_emulator /bin/sh -c apk add --no-cache npm argon2-libs python3   && npm i -g @bitwarden/cli@${VERSION}" did not complete successfully: exit code: 1
------
 > [3/4] RUN   apk add --no-cache npm argon2-libs python3   && npm i -g @bitwarden/cli@2024.1.0:
67.98 npm ERR! node-pre-gyp ERR! stack     at maybeClose (node:internal/child_process:1105:16)
67.98 npm ERR! node-pre-gyp ERR! stack     at ChildProcess._handle.onexit (node:internal/child_process:305:5)
67.98 npm ERR! node-pre-gyp ERR! System Linux 6.2.0-1018-azure
67.98 npm ERR! node-pre-gyp ERR! command "/usr/bin/node" "/usr/local/lib/node_modules/@bitwarden/cli/node_modules/.bin/node-pre-gyp" "install" "--fallback-to-build"
67.98 npm ERR! node-pre-gyp ERR! cwd /usr/local/lib/node_modules/@bitwarden/cli/node_modules/argon2
67.98 npm ERR! node-pre-gyp ERR! node -v v21.4.0
67.98 npm ERR! node-pre-gyp ERR! node-pre-gyp -v v1.0.11
67.98 npm ERR! node-pre-gyp ERR! not ok
68.01 
68.01 npm ERR! A complete log of this run can be found in: /root/.npm/_logs/2024-01-11T21_28_24_194Z-debug-0.log
------
Dockerfile:16
--------------------
  15 |     
  16 | >>> RUN \
  17 | >>>   apk add --no-cache npm argon2-libs python3 \
  18 | >>>   && npm i -g @bitwarden/cli@${VERSION}
  19 |     
--------------------
ERROR: failed to solve: process "/dev/.buildkit_qemu_emulator /bin/sh -c apk add --no-cache npm argon2-libs python3   && npm i -g @bitwarden/cli@${VERSION}" did not complete successfully: exit code: 1
Error: buildx failed with: ERROR: failed to solve: process "/dev/.buildkit_qemu_emulator /bin/sh -c apk add --no-cache npm argon2-libs python3   && npm i -g @bitwarden/cli@${VERSION}" did not complete successfully: exit code: 1

canutoalex commented 4 months ago

Hi @MGibson1, does this mean this problem is fixed or is it going to be part of a future release? Because I just tried it again at it's still happening.

trmartin4 commented 4 months ago

@canutoalex this was closed automatically as it was tied to the PR that is now in our main branch. This will be included in our next CLI release.

bitwarden / clients