You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
package.json --build-from-source for all dependencies #58
Is there a way, in a package.json, to tell all dependencies (using node-pre-gyp) to build from source ? That could happen when one doesn't want prebuilt binaries of the dependencies at all.
It's not really only about my need, which is already covered, thank you.
The use case is simple: don't download, install, and execute binaries from an untrusted source.
While it is possible to put a relatively high level of trust into a given version of a npm module (because code can be reviewed and module@version cannot change, provided i trust npmjs.org repository, or if i don't i can trust a git commit hash, or my own npmjs mirror), the question i ask is:
Do you have a way to ensure the binaries downloaded by node-pre-gyp have not been tampered ?
Put differently: how are you certain a given binary was built exactly from the source code that can be reviewed in the git repository ?
While i respect and understand how practical a solution it is, there should be a (global) way to decide how one wants to install (the untrusted, fast, solution, or the trusted, less practical solution) by default. Something like a npm config value.
If i package module B using sqlite3, and that's it, i can put a warning in the README explaining how to install from source.
Now if someone wants to package module A using module B, and so on, there's a good chance users will download and execute untrusted binaries without ever knowing it.
The use case is simple: don't download, install, and execute binaries from an untrusted source.
I like your idea of a npm config like option to make it possible for --build-from-source to be the global default. Or alternatively we could consider implementing a one-time acceptance/approval per host like how ssh works and is described at npm/npm#1891 (comment).
Do you have a way to ensure the binaries downloaded by node-pre-gyp have not been tampered ?
Put differently: how are you certain a given binary was built exactly from the source code that can be reviewed in the git repository ?
This is a very important issue.
I think the first step is to support shasum checking. This is tracked at #6. But this is not at all a complete solution of course.
I think the next step is package signing support. This is something that npm itself appears to still be working on as seen in npm/npm#4233 and npm/npm#1891 (comment). Ideally node-pre-gyp could start helping test any future modules that would implement this in npm core.
I just closed #6 because I've not seen a strong need for it. As far as package signing, I've not seen movement on it in npm? As far as respecting an npm config "always build from source no matter way setting" this seems like an easy addition and I would accept a pull request for it. I don't see other actionable issues here, but if I'm missing anything please create a new issue to discuss.
Just stumbled upon this as well. Not too happy with getting 3rd party binaries.
So, how exactly does one ensure node-pre-gyp never installs stuff from the "remote"? The --build-from-source above source isn't something one can put in ~/.npmrc, is it, like they can with ignore-scripts?
Adding --build-from-source is currently the only way, and I'm not aware of a way to trigger than via ~/.npmrc so what is needed is a patch to have node-pre-gyp respect some specific ~/.npmrc setting. Want to create a new issue for that?
Stumbled upon the same issue 4 years later and was surprised I've already commented here. :P Why is this issue still closed? After all, it is still the default search engine result as it perfectly describes what we, security conscious people, all want.
Reacted by Nay Yaung, jD91mZM2, John Murray, Ilya, Null, Blake Wu(B-law), Yisi, Eric Mika, Rodion Kokhan, taelfrinn and 10 more
Activity
springmeyer commentedon Apr 1, 2014
Can you explain your usecase a bit more? If you have an application called
foothen:Should trigger all dependences in package.json that might be packaged with node-pre-gyp (and might provide binaries) to be source compiled.
Does that cover your need?
kapouer commentedon Apr 1, 2014
It's not really only about my need, which is already covered, thank you.
The use case is simple: don't download, install, and execute binaries from an untrusted source.
While it is possible to put a relatively high level of trust into a given version of a npm module (because code can be reviewed and module@version cannot change, provided i trust npmjs.org repository, or if i don't i can trust a git commit hash, or my own npmjs mirror), the question i ask is:
Do you have a way to ensure the binaries downloaded by node-pre-gyp have not been tampered ?
Put differently: how are you certain a given binary was built exactly from the source code that can be reviewed in the git repository ?
While i respect and understand how practical a solution it is, there should be a (global) way to decide how one wants to install (the untrusted, fast, solution, or the trusted, less practical solution) by default. Something like a npm config value.
If i package module B using sqlite3, and that's it, i can put a warning in the README explaining how to install from source.
Now if someone wants to package module A using module B, and so on, there's a good chance users will download and execute untrusted binaries without ever knowing it.
springmeyer commentedon Apr 1, 2014
I like your idea of a
npm configlike option to make it possible for--build-from-sourceto be the global default. Or alternatively we could consider implementing a one-time acceptance/approval perhostlike how ssh works and is described at npm/npm#1891 (comment).This is a very important issue.
I think the first step is to support shasum checking. This is tracked at #6. But this is not at all a complete solution of course.
I think the next step is package signing support. This is something that npm itself appears to still be working on as seen in npm/npm#4233 and npm/npm#1891 (comment). Ideally node-pre-gyp could start helping test any future modules that would implement this in npm core.
springmeyer commentedon Oct 17, 2014
I just closed #6 because I've not seen a strong need for it. As far as package signing, I've not seen movement on it in npm? As far as respecting an
npm config"always build from source no matter way setting" this seems like an easy addition and I would accept a pull request for it. I don't see other actionable issues here, but if I'm missing anything please create a new issue to discuss.moll commentedon Dec 23, 2014
Just stumbled upon this as well. Not too happy with getting 3rd party binaries.
So, how exactly does one ensure node-pre-gyp never installs stuff from the "remote"? The
--build-from-sourceabove source isn't something one can put in~/.npmrc, is it, like they can withignore-scripts?springmeyer commentedon Dec 23, 2014
Adding
--build-from-sourceis currently the only way, and I'm not aware of a way to trigger than via~/.npmrcso what is needed is a patch to have node-pre-gyp respect some specific~/.npmrcsetting. Want to create a new issue for that?moll commentedon Dec 23, 2014
Hey. Well, this particular issue already exists, came up on the search results and has pretty much the same goal. Why not open it?
moll commentedon Oct 15, 2018
Stumbled upon the same issue 4 years later and was surprised I've already commented here. :P Why is this issue still closed? After all, it is still the default search engine result as it perfectly describes what we, security conscious people, all want.