Bug 2328456 - Review Request: node-gyp - Node.js native addon build tool
Summary: Review Request: node-gyp - Node.js native addon build tool
Keywords:
Status: ASSIGNED
Alias: None
Product: Fedora
Classification: Fedora
Component: Package Review
Version: rawhide
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Fabio Porcedda
QA Contact: Fedora Extras Quality Assurance
URL: https://github.com/nodejs/node-gyp
Whiteboard: Unretirement
Depends On:
Blocks: 2328457
TreeView+ depends on / blocked
 
Reported: 2024-11-23 04:59 UTC by Michael Cronenworth
Modified: 2026-08-27 19:31 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Type: ---
Embargoed:


Attachments (Terms of Use)
The .spec file difference from Copr build 8305692 to 10900219 (3.29 KB, patch)
2026-08-25 03:48 UTC, Fedora Review Service
no flags Details | Diff

Description Michael Cronenworth 2024-11-23 04:59:24 UTC
Spec URL: https://michael.cronenworth.com/RPMS/node-gyp.spec
SRPM URL: https://michael.cronenworth.com/RPMS/node-gyp-10.2.0-0.1.fc41.src.rpm
Description: Node.js native addon build tool
Fedora Account System Username: mooninite

This review is to unretire the package. The 'zwave-js-ui' package requires this package. I will be opening a separate package review for 'zwave-js-ui' soon.

Comment 1 Fedora Review Service 2024-11-23 05:04:59 UTC
Copr build:
https://copr.fedorainfracloud.org/coprs/build/8305692
(succeeded)

Review template:
https://download.copr.fedorainfracloud.org/results/@fedora-review/fedora-review-2328456-node-gyp/fedora-rawhide-x86_64/08305692-node-gyp/fedora-review/review.txt

Found issues:

- License file LICENSE.APACHE is not marked as %license
  Read more: https://docs.fedoraproject.org/en-US/packaging-guidelines/LicensingGuidelines/#_license_text
- A package with this name already exists. Please check https://src.fedoraproject.org/rpms/node-gyp
  Read more: https://docs.fedoraproject.org/en-US/packaging-guidelines/Naming/#_conflicting_package_names

Please know that there can be false-positives.

---
This comment was created by the fedora-review-service
https://github.com/FrostyX/fedora-review-service

If you want to trigger a new Copr build, add a comment containing new
Spec and SRPM URLs or [fedora-review-service-build] string.

Comment 2 Package Review 2025-11-24 00:45:20 UTC
This is an automatic check from review-stats script.

This review request ticket hasn't been updated for some time. We're sorry
it is taking so long. If you're still interested in packaging this software
into Fedora repositories, please respond to this comment clearing the
NEEDINFO flag.

You may want to update the specfile and the src.rpm to the latest version
available and to propose a review swap on Fedora devel mailing list to increase
chances to have your package reviewed. If this is your first package and you
need a sponsor, you may want to post some informal reviews. Read more at
https://fedoraproject.org/wiki/How_to_get_sponsored_into_the_packager_group.

Without any reply, this request will shortly be considered abandoned
and will be closed.
Thank you for your patience.

Comment 3 Michael Cronenworth 2025-12-02 15:33:35 UTC
I'd still like to get this in. I recognize I need to update to the latest version.

Comment 4 Michael Cronenworth 2026-01-31 20:08:51 UTC
Spec URL: https://michael.cronenworth.com/RPMS/node-gyp.spec
SRPM URL: https://michael.cronenworth.com/RPMS/node-gyp-12.2.0-0.1.fc44.src.rpm

Updated to the latest release.

Comment 5 Fabio Porcedda 2026-08-16 10:57:42 UTC
Are you interested to swap the package review with another nodejs package (bug 2511720)?

Comment 6 Michael Cronenworth 2026-08-18 03:04:33 UTC
Sure! I'll update the spec and srpm since it's been almost 8 months.

Spec URL: https://michael.cronenworth.com/RPMS/node-gyp.spec
SRPM URL: https://michael.cronenworth.com/RPMS/node-gyp-13.0.1-0.1.fc46.src.rpm

Comment 7 Fabio Porcedda 2026-08-19 19:30:06 UTC
(In reply to Michael Cronenworth from comment #6)
> Sure! I'll update the spec and srpm since it's been almost 8 months.
> 
> Spec URL: https://michael.cronenworth.com/RPMS/node-gyp.spec
> SRPM URL:
> https://michael.cronenworth.com/RPMS/node-gyp-13.0.1-0.1.fc46.src.rpm

Issues:
- Add a comment about the upstream status of the patch, even something like "not sent upstream because is specific for Fedora"
- Use a better description than the summary, for example the first part of the project description or somethink like that:
  "node-gyp is a cross-platform command-line tool written in Node.js for compiling native addon modules for Node.js. It contains a vendored copy of the gyp-next project that was previously used by the Chromium team and extended to support the development of Node.js native addons."
- Release should be >= 1 or use %autorelease
- Because the system gyp is being used instead of the bundled one, remove it in %prep instead of copying it in %install "cp -rp package.json addon.gypi addon-rpm.gypi bin/ gyp/ lib/ %{buildroot}%{nodejs_sitelib}/%{name}"
- upstream dependency is "node": "^22.22.2 || ^24.15.0 || >=26.0.0" but the Fedora package has an unversioned dependency, it should exclude nodejs20, build.log:
  WARNING: The nodejs(engine) dependency contains an OR (||) dependency: '^22.22.2 || ^24.15.0 || >=26.0.0.
- In line 31 is being used an undefined macro that will be put literally in the final rpm, does it make sense?
- Source2 is being included but not used, there are some tests that can be used in %check instead?

Suggestions:
- Use %autorelease and %autochangelog

Comment 8 Michael Cronenworth 2026-08-20 03:28:18 UTC
(In reply to Fabio Porcedda from comment #7)
> Issues:
> - Add a comment about the upstream status of the patch, even something like
> "not sent upstream because is specific for Fedora"
> - Use a better description than the summary, for example the first part of
> the project description or somethink like that:
>   "node-gyp is a cross-platform command-line tool written in Node.js for
> compiling native addon modules for Node.js. It contains a vendored copy of
> the gyp-next project that was previously used by the Chromium team and
> extended to support the development of Node.js native addons."

Changed.

> - Release should be >= 1 or use %autorelease

It has been my style for as long as I have packaged to use 0.x for package reviews and use '1' for post-review, package import. I'll change it now.

> - Because the system gyp is being used instead of the bundled one, remove it
> in %prep instead of copying it in %install "cp -rp package.json addon.gypi
> addon-rpm.gypi bin/ gyp/ lib/ %{buildroot}%{nodejs_sitelib}/%{name}"
> - upstream dependency is "node": "^22.22.2 || ^24.15.0 || >=26.0.0" but the
> Fedora package has an unversioned dependency, it should exclude nodejs20,
> build.log:
>   WARNING: The nodejs(engine) dependency contains an OR (||) dependency:
> '^22.22.2 || ^24.15.0 || >=26.0.0.

Thanks! I am not a NodeJS developer or packager.

> - In line 31 is being used an undefined macro that will be put literally in
> the final rpm, does it make sense?

This review is so old I do not recall where the macro originated. It'll be fixed.

> - Source2 is being included but not used, there are some tests that can be
> used in %check instead?

The test files are not included in the source tarball. Should the -dev.tgz be excluded?

> Suggestions:
> - Use %autorelease and %autochangelog

I prefer manual methods. They are still permitted. I'll post a new spec once the SOURCE2 issue is resolved.

Comment 9 Fabio Porcedda 2026-08-21 18:35:02 UTC
(In reply to Michael Cronenworth from comment #8)
> (In reply to Fabio Porcedda from comment #7)
> > Issues:
> > - Add a comment about the upstream status of the patch, even something like
> > "not sent upstream because is specific for Fedora"
> > - Use a better description than the summary, for example the first part of
> > the project description or somethink like that:
> >   "node-gyp is a cross-platform command-line tool written in Node.js for
> > compiling native addon modules for Node.js. It contains a vendored copy of
> > the gyp-next project that was previously used by the Chromium team and
> > extended to support the development of Node.js native addons."
> 
> Changed.
> 
> > - Release should be >= 1 or use %autorelease
> 
> It has been my style for as long as I have packaged to use 0.x for package
> reviews and use '1' for post-review, package import. I'll change it now.
> 
> > - Because the system gyp is being used instead of the bundled one, remove it
> > in %prep instead of copying it in %install "cp -rp package.json addon.gypi
> > addon-rpm.gypi bin/ gyp/ lib/ %{buildroot}%{nodejs_sitelib}/%{name}"
> > - upstream dependency is "node": "^22.22.2 || ^24.15.0 || >=26.0.0" but the
> > Fedora package has an unversioned dependency, it should exclude nodejs20,
> > build.log:
> >   WARNING: The nodejs(engine) dependency contains an OR (||) dependency:
> > '^22.22.2 || ^24.15.0 || >=26.0.0.
> 
> Thanks! I am not a NodeJS developer or packager.
> 
> > - In line 31 is being used an undefined macro that will be put literally in
> > the final rpm, does it make sense?
> 
> This review is so old I do not recall where the macro originated. It'll be
> fixed.
> 
> > - Source2 is being included but not used, there are some tests that can be
> > used in %check instead?
> 
> The test files are not included in the source tarball. Should the -dev.tgz
> be excluded?

The tests are not included in the source tarball retrieved by nodejs-packaging-bundler, but they are present in the GitHub source tarball.
So, in order to run the tests, you can use the GitHub source tarball.
You can choose to use the GitHub source tarball and run the tests, or instead exclude the -dev.tgz.

In my case, for the markdownlint-cli2 package, I had the same issue, and I've chosen to use the GitHub source tarball in order to run the tests.

The Fedora guidelines just say that the test suite SHOULD be executed, so it’s not a MUST—it’s up to you.

> > Suggestions:
> > - Use %autorelease and %autochangelog
> 
> I prefer manual methods. They are still permitted. I'll post a new spec once
> the SOURCE2 issue is resolved.

Comment 10 Michael Cronenworth 2026-08-24 03:49:32 UTC
Spec URL: https://michael.cronenworth.com/RPMS/node-gyp.spec
SRPM URL: https://michael.cronenworth.com/RPMS/node-gyp-13.0.1-1.fc46.src.rpm

- I 'hard coded' nodejs 24 as the configure.js link. I'm unsure if this is safe or not.
- I had to disable two tests that required network access. Other tests passed.

Comment 11 Fabio Porcedda 2026-08-24 20:56:15 UTC


(In reply to Michael Cronenworth from comment #10)
> Spec URL: https://michael.cronenworth.com/RPMS/node-gyp.spec
> SRPM URL: https://michael.cronenworth.com/RPMS/node-gyp-13.0.1-1.fc46.src.rpm
> 
> - I 'hard coded' nodejs 24 as the configure.js link. I'm unsure if this is
> safe or not.

Why exclude nodejs26?
I think "Requires/BuildRequires:  (nodejs24-devel or nodejs26-devel)" should be better.

> - I had to disable two tests that required network access. Other tests
> passed.

Issue found:
- Please add for each patch the upstream status
- Because you are using the system gyp package you must remove in %prep the bundled version of gyp (rm -r gyp)
- In the %description the reference to the bundled gyp-next should be removed because you use the system gyp 
- "Requires:       nodejs(engine) > 20" still accept nodejs20, to fix that use "Requires:       (nodejs24-devel or nodejs26-devel)"

Comment 12 Michael Cronenworth 2026-08-25 03:44:17 UTC
Issues addressed.

Spec URL: https://michael.cronenworth.com/RPMS/node-gyp.spec
SRPM URL: https://michael.cronenworth.com/RPMS/node-gyp-13.0.1-1.fc46.src.rpm

Comment 13 Fedora Review Service 2026-08-25 03:48:53 UTC
Created attachment 2155561 [details]
The .spec file difference from Copr build 8305692 to 10900219

Comment 14 Fedora Review Service 2026-08-25 03:48:56 UTC
Copr build:
https://copr.fedorainfracloud.org/coprs/build/10900219
(succeeded)

Review template:
https://download.copr.fedorainfracloud.org/results/@fedora-review/fedora-review-2328456-node-gyp/fedora-rawhide-x86_64/10900219-node-gyp/fedora-review/review.txt

Found issues:

- License file LICENSE.md is not marked as %license
  Read more: https://docs.fedoraproject.org/en-US/packaging-guidelines/LicensingGuidelines/#_license_text
- A package with this name already exists. Please check https://src.fedoraproject.org/rpms/node-gyp
  Read more: https://docs.fedoraproject.org/en-US/packaging-guidelines/Naming/#_conflicting_package_names

Please know that there can be false-positives.

---
This comment was created by the fedora-review-service
https://github.com/FrostyX/fedora-review-service

If you want to trigger a new Copr build, add a comment containing new
Spec and SRPM URLs or [fedora-review-service-build] string.

Comment 15 Fabio Porcedda 2026-08-27 19:31:47 UTC
(In reply to Michael Cronenworth from comment #12)
> Issues addressed.
> 
> Spec URL: https://michael.cronenworth.com/RPMS/node-gyp.spec
> SRPM URL: https://michael.cronenworth.com/RPMS/node-gyp-13.0.1-1.fc46.src.rpm

Hi,
when node is not already installed on the system, rpmspec emits:
     sh: line 1: node: command not found

because the command is executed while parsing the spec instead of during %prep.

Also the association to the nodejs-xx version is static. For example, if the package is built with nodejs24 associated, but at runtime only nodejs22 is available because it's the only one installed:
  dnf install node-gyp nodejs22

node-gyp installs fine, but when executed it tries to use nodejs24, while only nodejs22 is available.

I think the best solution is to detect at runtime which nodejs version should be used. The node-gyp-system-node-gyp.patch should be updated to do that.


Note You need to log in before you can comment on or make changes to this bug.