Bug 2491084 - binary executable content in node_modules
Summary: binary executable content in node_modules
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Fedora
Classification: Fedora
Component: openclaw
Version: rawhide
Hardware: Unspecified
OS: Linux
unspecified
medium
Target Milestone: ---
Assignee: Tom.Rix
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-06-20 21:07 UTC by Gordon Messmer
Modified: 2026-07-28 15:52 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2026-07-28 15:52:14 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Gordon Messmer 2026-06-20 21:07:17 UTC
The nodejs-packaging-bunder does not strip executable binary files from a node_modules directory before creating a "source" archive for dist-git. This has resulted in a number of Fedora packages being built from archives that include pre-built executables which are not allowed by policy.

In some cases, the prohibited content is not essential to the build process and removing it will not further complicate the RPM build process.

Reproducible: Always

Steps to Reproduce:
1. tar xf *nm-*.tgz
2. find node_modules* -type f -exec file {} + | grep -E 'ELF|Mach-O|PE32|WebAssembly'
3.

Comment 1 Gordon Messmer 2026-06-20 21:14:25 UTC
See https://pagure.io/fesco/issue/3622


Note You need to log in before you can comment on or make changes to this bug.