Open sarcasticadmin opened 3 months ago
Thanks for bringing this up @sarcasticadmin! I always assumed npm takes care of all the integrity stuff for us, but seems like it's not always the case.
Based on the npm issues you linked above, it seems like rm -rf node_modules package-lock.json
should be enough to fill in the missing hashes. The unfortunate part is we will lose our lock file and dependencies will be upgraded. If you could find a way to add the hashes while keeping the existing package-lock, that would be awesome.
If not, once you confirm the issue on your side is resolved, feel free to make a PR (or just let me know here and I can make the PR myself).
Let me give that a go and Ill raise a PR shortly
Wave SDK Version, OS
Im attempting to package up waved and components from
v1.1.1
tag. My system is using the following versions:Actual behavior
serveral ui dependencies are missing
integrity
andresolved
fields. Some examples https://github.com/h2oai/wave/blob/5fd6aa5447859e9266ed42a6f9b0583281e62c63/ui/package-lock.json#L17944-L17946 and https://github.com/h2oai/wave/blob/5fd6aa5447859e9266ed42a6f9b0583281e62c63/ui/package-lock.json#L17994-L17997These missing fields causes the nix build process to fail since it prefetchs and verifies each of the dependencies then performs a npm build offline in a sandbox to ensure reproducibility. This is the result of
nix-build
againstv1.1.1
for the ui:This seems to be an outstanding issue within npm if the packages are already cached locally and npm install is used to generate the package-lock.json : https://github.com/npm/cli/issues/4460 and https://github.com/npm/cli/issues/6301
Expected behavior
In order to assure reproducible installations, every package listed in a
package-lock.json
should contain aresolved
andintegrity
field so it can be fetched from a registry.Steps To Reproduce
Unsure how to reproduce this within
npm
, it seems to happily proceed without caring about the missingresolved
andintegrity
fields. Here is a simple version to verify usingnix
Copy the following into
default.nix
:nix-build
from the same directory wheredefault.nix
existsI'm happy to help troubleshoot or provide more info.