Wiki - https://fedoraproject.org/wiki/Changes/NodejsNodeModulesPath Discussion thread - https://discussion.fedoraproject.org/t/f43-change-proposal-nodejs-node-modules-path-self-contained/157324
This is a proposed Change for Fedora Linux. This document represents a proposed Change. As part of the Changes process, proposals are publicly announced in order to receive community feedback. This proposal will only be implemented if approved by the Fedora Engineering Steering Committee. == Summary == Nodejs needs a new shared stream agnostic installation folder for modules. == Owner == * Name: [[User:tjuhasz| Tomas Juhasz]] * Email: tjuh...@redhat.com * Name: [[User:jstanek| Jan Stanek]] * Email: jsta...@redhat.com * Name: [[User:aradchen| Andrei Radchenko]] * Email: aradc...@redhat.com == Detailed Description == This proposal is a part of a larger effort to improve the way we package Nodejs for Fedora and RHEL. The other parts are [[Changes/NodejsAlternativesSystem]] and [[Changes/NodeJSMetapackages]]. This effort is specifically focused on allowing users to install '''any supported''' version of Nodejs, without specifying a major version. === Current Nodejs Situation === Currently, Fedora's Node.js setup uses a symlink: `%{_libdir}/node_modules` points to a version-specific folder like `%{_libdir}/node_modulesXX` (e.g., `%{_libdir}/node_modules20` or `%{_libdir}/node_modules22`). Primary motivation for change is an ongoing effort to de-bundle certain parts of Node.js, particularly NPM packages that include pre-built WebAssembly (WASM) binary blobs. With multiple Nodejs versions present in Fedora, and upstream recommendations against globally shared NPM packages in consideration, we need a better way to store these de-bundled packages which could be shared between multiple streams. === Suggested Change === Proposed way of doing this is to change `%{_libdir}/node_modules` from a symlink to a static shared folder. This static `%{_libdir}/node_modules` path will be used for version-agnostic modules that can be shared across multiple Nodejs versions. For version-specific dependencies, the existing `%{_libdir}/node_modulesXX` folders (e.g., `%{_libdir}/node_modules20`, `%{_libdir}/node_modules22`) will continue to be used. === Alternative path options === If the change of `%{_libdir}/node_modules` from a symlink to a shared folder is not agreeable a alternative path could also be used for the same purpose e.g.: * <code>%{_libdir}/nodejs/packages/shared</code> for NPM packages that can be shared between multiple NodeJS major versions. This should be the default path for the unbundled packages unless a stream is identified to need a specific version. * <code>%{_libdir}/nodejs/packages/<major_version></code> for NPM packages that are specifically used by a single NodeJS major version. Reserved for compat-style packages. Packages installed in these paths are assumed to be used by a non-npm-related loading mechanism; for NodeJS specifically, via the "Shared builtins" mechanism ([https://github.com/nodejs/node/blob/main/BUILDING.md#building-to-use-shared-dependencies-at-runtime upstream docs]). == Feedback == == Benefit to Fedora == By having downstream-standartized path for "Shared builtins" modules, we can start removing potentially unsafe pre-build WASM (binary) blobs from the NodeJS sources, rebuilding them on our infrastructure from trusted sources. Accommodating single default shared directory will reduce work necessary for unbundling the packages from several NodeJS major versions at once, while the preservation of version-specific paths will allow for compatibility packages where necessary. == Scope == * Proposal owners: Adding a small `%pretrans` scriptlet for turning `/usr/lib/node_modules` into a separate directory in all active nodejs streams * Other developers: Any developers who package npm packages will need to verify, that their RPM will be functional after the `%{_libdir}/node_modules` will change from a symlink to a folder and if necessary rebuild their packages so that the files are present in `%{_libdir}/node_modules` and rather then in e.g. `%{_libdir}/node_modules_22`. * Release engineering: N/A * Policies and guidelines: N/A. * Trademark approval: N/A (not needed for this Change) * Alignment with the Fedora Strategy: == Upgrade/compatibility impact == There should be no need for manual intervention. == Early Testing (Optional) == == How To Test == Allow to install nodejs dependencies like `nodejs-cjs-module-lexer` into a shared static folder. == User Experience == User experience should not be affected in any way. == Dependencies == None == Contingency Plan == * Contingency mechanism: Reverting the change back to using `%{_libdir}/node_modules` as a symlink pointing to version specific folders. * Contingency deadline: N/A * Block release: N/A == Documentation == This Page. == Release Notes == -- Aoife Moloney Fedora Operations Architect Fedora Project Matrix: @amoloney:fedora.im IRC: amoloney -- _______________________________________________ devel-announce mailing list -- devel-annou...@lists.fedoraproject.org To unsubscribe send an email to devel-announce-le...@lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/devel-annou...@lists.fedoraproject.org Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue -- _______________________________________________ devel mailing list -- devel@lists.fedoraproject.org To unsubscribe send an email to devel-le...@lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue