[BUG] Dependencies scripts don't run when using v1 shrinkwrap

koterpillar commented 2 years ago

Is there an existing issue for this?

[X] I have searched the existing issues

This issue exists in the latest npm version

[X] I am using the latest npm

Current Behavior

When:

Installing a package (A)
Which uses shrinkwrap version 1 (produced by npm 6)
And has a dependency (B)
Which is using node-gyp and a custom install script

B's custom install script does not run, instead it is replaced with node-gyp rebuild.

Example:

@freekii/layerone-keytar@1.0.10 has been built and uploaded using npm 6
It has npm-shrinkwrap.json with "lockfileVersion": 1
It has keytar as a dependency
keytar has prebuild-install || npm run build

When installing @freekii/layerone-keytar@1.0.10, keytar's install script will not run, falling back to node-gyp rebuild. If the machine has no Python and required system libraries, that will fail whereas the prebuild-install would have succeeded.

Expected Behavior

Dependencies' install scripts should run as specified in their package.json.

(Using example above) Installing @freekii/layerone-keytar@1.0.10 runs keytar's prebuild-install.

Steps To Reproduce

Create an empty npm package with a single dependency keytar (or use existing @freekii/layerone-keytar@1.0.10 and skip to sten 4).
Using npm 6, run npm shrinkwrap.
Publish the package to npm with the generated shrinkwrap.
On a machine without Python or C build tools (e.g. node:16 Docker container), install the above package from npm.
Observe the error from gyp:

npm ERR! code 1
npm ERR! path /usr/local/lib/node_modules/@freekii/layerone-keytar/node_modules/keytar
npm ERR! command failed
npm ERR! command sh -c -- node-gyp rebuild
(...)

Environment

npm: 8.19.2
Node.js: 16.17.0
OS Name: Linux
System Model Name: Docker container, via Macbook Pro

npm config:

; node bin location = /usr/local/bin/node
; node version = v16.17.0
; npm local prefix = /
; npm version = 8.19.2
; cwd = /
; HOME = /root
; Run `npm config ls -l` to show all defaults.

koterpillar commented 2 years ago

Please note this is not a bug in npm 6. It was only used to produce the example package, but I expect npm 8 to be able to install older packages from the registry regardless.

koterpillar commented 2 years ago

I believe the meta.loadedFromDisk check is causing the bug here: https://github.com/npm/cli/blob/e5761b9adafe8607ad68baa9599ad4eb228bc6be/workspaces/arborist/lib/arborist/rebuild.js#L257

npm / cli