Bug 2491086 - binary executable content in node_modules
Summary: binary executable content in node_modules
Keywords:
Status: CLOSED RAWHIDE
Alias: None
Product: Fedora
Classification: Fedora
Component: nodejs-postcss-url
Version: rawhide
Hardware: Unspecified
OS: Linux
unspecified
medium
Target Milestone: ---
Assignee: Jiří Kyjovský
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-06-20 21:07 UTC by Gordon Messmer
Modified: 2026-07-02 13:03 UTC (History)
4 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2026-07-02 13:03:47 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Gordon Messmer 2026-06-20 21:07:27 UTC
The nodejs-packaging-bunder does not strip executable binary files from a node_modules directory before creating a "source" archive for dist-git. This has resulted in a number of Fedora packages being built from archives that include pre-built executables which are not allowed by policy.

In some cases, the prohibited content is not essential to the build process and removing it will not further complicate the RPM build process.

Reproducible: Always

Steps to Reproduce:
1. tar xf *nm-*.tgz
2. find node_modules* -type f -exec file {} + | grep -E 'ELF|Mach-O|PE32|WebAssembly'
3.

Comment 1 Gordon Messmer 2026-06-20 21:14:37 UTC
See https://pagure.io/fesco/issue/3622

Comment 2 Miroslav Suchý 2026-07-02 10:59:13 UTC
Resolved in https://src.fedoraproject.org/rpms/nodejs-postcss-url/pull-request/2


Note You need to log in before you can comment on or make changes to this bug.