Hi, which versions of nodejs does this affect and how urgent are the fixes?

Currently osbuild can not switch streams so this only affects the default stream of 10. Customers building edge systems fail if they include npm or nodejs.

I am sorry to inform you that v10 doesn't receive any updates or fixes anymore. It is the default version, because it was the first version introduced in RHEL8, but it's been dead for years. I can bring it up with our PM, but I don't think anything will be done about v10.

Please let me know if you need a fix included in newer releases, currently supported streams are v14, v16 and v18 with v14 going EOL very soon.

The symlink in question was added by the following Fedora commit: https://src.fedoraproject.org/rpms/nodejs18/c/2526ca953f7d2de94348a77127a85b39a4a8407d

Reported RFE for rpminspect that could warn about `/usr/etc` content early on: https://github.com/rpminspect/rpminspect/issues/1133

I just found that removing /usr/etc/npmrc does not work, it would make the npmrc not work entirely because the code looks primarily to ${prefix}/etc/npmrc:

#> echo 'loglevel="silly"' >>/etc/npmrc
#> npm install express 2>&1 | grep loadBundles
npm timing reify:loadBundles Completed in 0ms
#> unlink /usr/etc/npmrc 
#> npm install express 2>&1 | grep loadBundles
<nothing>

So, we need not only remove /usr/etc/npmrc, but also fix the code to look directly to /etc/npmrc. This might ideally be an upstream fix, that could let users to specify npmrc location somewhere else than in ${prefix}/etc/npmrc during the build.

I did some digging in the sources of npm on what we can do with the expected location of the file, and I see some options.

npm loads up to 4 (!) configuration files in addition to the "hardcoded" defaults: builtin, project, user, and global npmrc; the global is the one we have trouble with. The location of this file is determined by the "globalconfig" config value, which defaults to "$(prefix)/etc/npmrc". Since it is a configuration value, it can be set via CLI, earlier configuration files or environment variables. In this case, we can (and probably should) utilize the builtin npmrc – it is intended for distribution-level configuration and effectively overrides the "hardcoded" defaults (`npm config list -l` even shows the new values as the defaults). The builtin npmrc should be located at "<npm module>/npmrc" (i.e. /usr/lib/node_modules/npm/npmrc).

So for future packaging, I suggest using this file for setting the globalconfig path; I'll start submitting patches to Fedora streams once I wrap my head around the new structure. However, this can take some time to propagate to (any) RHEL.

For the osbuilder, it is possible to use environment variables to point npm to the correct location? According to docs (from the nodejs:10 stream), `npm_config_globalconfig=/etc/npmrc` environment variable should provide the same effect and allow us to remove /usr/etc/npmr symling during build. (Note: NPM_CONFIG_GLOBALCONFIG name should also work, but apparently can be internally overriden by the lowercase version; better use the lowercase to be safe.)

(In reply to Jan Staněk from comment #12) (Accidentally submitted the change too soon.)

John, is the environment variable approach something you can use for the image build? Or do you need any change to happen on the packaging side?

The Fedora PR that does away with the symlink: https://src.fedoraproject.org/rpms/nodejs20/pull-request/1. Similar PRs will be opened against other NodeJS streams (both Fedora and EL) once this one is reviewed and merged.

The needinfo request[s] on this closed bug have been removed as they have been unresolved for 120 days