Bug 2491087

Summary: binary executable content in node_modules
Product: [Fedora] Fedora Reporter: Gordon Messmer <gordon.messmer>
Component: nodejs-aw-webuiAssignee: wojnilowicz <lukasz.wojnilowicz>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: unspecified    
Version: 45CC: lukasz.wojnilowicz, maxwell
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Gordon Messmer 2026-06-20 21:07:32 UTC
The nodejs-packaging-bunder does not strip executable binary files from a node_modules directory before creating a "source" archive for dist-git. This has resulted in a number of Fedora packages being built from archives that include pre-built executables which are not allowed by policy.

In some cases, the prohibited content is not essential to the build process and removing it will not further complicate the RPM build process.

Reproducible: Always

Steps to Reproduce:
1. tar xf *nm-*.tgz
2. find node_modules* -type f -exec file {} + | grep -E 'ELF|Mach-O|PE32|WebAssembly'
3.

Comment 1 Gordon Messmer 2026-06-20 21:14:42 UTC
See https://pagure.io/fesco/issue/3622

Comment 2 Aoife Moloney 2026-08-17 14:56:41 UTC
This bug appears to have been reported against 'rawhide' during the Fedora Linux 45 development cycle.
Changing version to 45.

Comment 3 Gordon Messmer 2026-08-25 21:37:23 UTC
# find . -type f -print | file --mime-type -N -f - | grep -E ': (application/x-executable|application/vnd.microsoft.portable-executable|application/x-mach-binary|application/wasm)$'
./aw-webui-7db0598d8526efc36e7ef411c7e523dd4111fcb0/node_modules/esbuild/bin/esbuild: application/x-executable
./aw-webui-7db0598d8526efc36e7ef411c7e523dd4111fcb0/node_modules/esbuild/lib/downloaded-@esbuild-linux-x64-esbuild: application/x-executable
./aw-webui-7db0598d8526efc36e7ef411c7e523dd4111fcb0/node_modules/clipboardy/fallbacks/linux/xsel: application/x-executable
./aw-webui-7db0598d8526efc36e7ef411c7e523dd4111fcb0/node_modules/clipboardy/fallbacks/windows/clipboard_i686.exe: application/vnd.microsoft.portable-executable
./aw-webui-7db0598d8526efc36e7ef411c7e523dd4111fcb0/node_modules/clipboardy/fallbacks/windows/clipboard_x86_64.exe: application/vnd.microsoft.portable-executable

esbuild is available as a Fedora package, and xsel can probably be safely deleted? The win32 exe files surely can.

Comment 4 Gordon Messmer 2026-08-25 22:29:54 UTC
Amending that list, it was not picking up wasm:

./aw-webui-7db0598d8526efc36e7ef411c7e523dd4111fcb0/node_modules/esbuild/bin/esbuild: application/x-executable
./aw-webui-7db0598d8526efc36e7ef411c7e523dd4111fcb0/node_modules/esbuild/lib/downloaded-@esbuild-linux-x64-esbuild: application/x-executable
./aw-webui-7db0598d8526efc36e7ef411c7e523dd4111fcb0/node_modules/clipboardy/fallbacks/linux/xsel: application/x-executable
./aw-webui-7db0598d8526efc36e7ef411c7e523dd4111fcb0/node_modules/clipboardy/fallbacks/windows/clipboard_i686.exe: application/vnd.microsoft.portable-executable
./aw-webui-7db0598d8526efc36e7ef411c7e523dd4111fcb0/node_modules/clipboardy/fallbacks/windows/clipboard_x86_64.exe: application/vnd.microsoft.portable-executable
./aw-webui-7db0598d8526efc36e7ef411c7e523dd4111fcb0/node_modules/@one-ini/wasm/one_ini_bg.wasm
./aw-webui-7db0598d8526efc36e7ef411c7e523dd4111fcb0/node_modules/clipboardy/fallbacks/windows/clipboard_i686.exe
./aw-webui-7db0598d8526efc36e7ef411c7e523dd4111fcb0/node_modules/clipboardy/fallbacks/windows/clipboard_x86_64.exe
./aw-webui-7db0598d8526efc36e7ef411c7e523dd4111fcb0/node_modules/ts-loader/node_modules/source-map/lib/mappings.wasm
./aw-webui-7db0598d8526efc36e7ef411c7e523dd4111fcb0/node_modules/workbox-build/node_modules/source-map/lib/mappings.wasm
./aw-webui-7db0598d8526efc36e7ef411c7e523dd4111fcb0/node_modules/workbox-webpack-plugin/node_modules/workbox-build/node_modules/source-map/lib/mappings.wasm

Comment 5 wojnilowicz 2026-08-29 10:37:09 UTC
(In reply to Gordon Messmer from comment #3)
> # find . -type f -print | file --mime-type -N -f - | grep -E ':
> (application/x-executable|application/vnd.microsoft.portable-
> executable|application/x-mach-binary|application/wasm)$'
> ./aw-webui-7db0598d8526efc36e7ef411c7e523dd4111fcb0/node_modules/esbuild/bin/
> esbuild: application/x-executable
> ./aw-webui-7db0598d8526efc36e7ef411c7e523dd4111fcb0/node_modules/esbuild/lib/
> downloaded-@esbuild-linux-x64-esbuild: application/x-executable
> ./aw-webui-7db0598d8526efc36e7ef411c7e523dd4111fcb0/node_modules/clipboardy/
> fallbacks/linux/xsel: application/x-executable
> ./aw-webui-7db0598d8526efc36e7ef411c7e523dd4111fcb0/node_modules/clipboardy/
> fallbacks/windows/clipboard_i686.exe:
> application/vnd.microsoft.portable-executable
> ./aw-webui-7db0598d8526efc36e7ef411c7e523dd4111fcb0/node_modules/clipboardy/
> fallbacks/windows/clipboard_x86_64.exe:
> application/vnd.microsoft.portable-executable
> 
> esbuild is available as a Fedora package, and xsel can probably be safely
> deleted? The win32 exe files surely can.

Thanks for the pointers. I removed those files and it still works fine. I'm not sure about *.wasm files. Will it work fine after removing them?

Anyway, I created a script at https://src.fedoraproject.org/rpms/nodejs-aw-webui/blob/rawhide/f/nodejs-packaging-bundler-wrapper.sh to remove this unwanted content for  future updates.