linux/poky.git/bitbake/lib/bb/fetch2/npmsw.py, branch master-next

bitbake: fetch2: npmsw: remove old lockfile format support

2025-01-08T11:34:04+00:00

Remove support for the old lockfile format. The old lockfile format is required by npm 6 / Node.js 14 which is out of maintenance [2]. [1] https://docs.npmjs.com/cli/v6/configuring-npm/package-lock-json [2] https://nodejs.org/en/about/previous-releases (Bitbake rev: 7824e19483d9b60a259d6e3a4c7068fade94f2bf) Signed-off-by: Stefan Herbrechtsmeier Signed-off-by: Richard Purdie

bitbake: fetch2: npmsw: ignore bundled dependencies in packages

2024-12-20T16:18:59+00:00

The npm package lock and shrinkwrap file list bundled dependencies which are supplied together with the parent dependency. The flag depends on the lock file version. Add the missing `inBundle` flag to packages list processing. (Bitbake rev: 042d7121ddc93c18306bf03d26ea774f66379a90) Signed-off-by: Stefan Herbrechtsmeier Signed-off-by: Richard Purdie

bitbake: fetch2/npmsw: allow packages not declaring a registry version

2024-08-23T08:48:48+00:00

We fetch npm dependencies from the npm-shrinkwrap.json file. They can point to a package on the NPM registry with a version field, or to a git/http/file URL with the resolved field. Such packages are allowed not to declare a registry version field because they may not have been published to the NPM registry. The previous implementation refuses to fetch such packages and throws an error. The resolved field contains the exact source, including the revision, wich we can use to pass as SRC_URI to the git/http/file fetcher. The integrity field is also mandatory for HTTP tarballs which will ensure reproducibility. So even if the version field is not present, we are still fetching a precise revision of the package. Another commit published along this stack is also required in the npm class to support these packages. v5: - improve commit message v3: - Split bitbake npmsw.py modification in another commit Co-authored-by: Tanguy Raufflet (Bitbake rev: 209982b5a3efc8081e65b4326bf9b64eef7f0ba0) Signed-off-by: Tanguy Raufflet Signed-off-by: Enguerrand de Ribaucourt Signed-off-by: Richard Purdie

bitbake: fetch2/npmsw: fix fetching git revisions not on master

2024-08-23T08:48:48+00:00

The NPM package.json documentation[1] states that git URLs may contain a commit-ish suffix to specify a specific revision. When running `npm install`, this revision will be looked for on any branch of the repository. The bitbake implementation however translates the URL stored in package.json into a git URL to be fetch by the bitbake git fetcher. The bitbake fetcher git.py, enforces the branch to be master by default. If the revision specified in the package.json is not on the master branch, the fetch will fail while the package.json is valid. To fix this, append the ";nobranch=1" suffix to the revision in the git URL to be fetched. This will make the bitbake git fetcher ignore the branch and respect the behavior of `npm install``. This can be tested with the following command: $ devtool add --npm-dev https://github.com/seapath/cockpit-cluster-dashboard.git -B version Which points to a project which has a package.json with a git URL: ```json "devDependencies": { "cockpit-repo": "git+https://github.com/cockpit-project/cockpit.git#d34cabacb8e5e1e028c7eea3d6e3b606d862b8ac" } ``` In this repo, the specified revision is on the "main" branch, which would fail without this fix. [1] https://docs.npmjs.com/cli/v10/configuring-npm/package-json#git-urls-as-dependencies Co-authored-by: Tanguy Raufflet (Bitbake rev: 37a35adf7882f231c13643dbf9168497c6a242a1) Signed-off-by: Tanguy Raufflet Signed-off-by: Enguerrand de Ribaucourt Signed-off-by: Richard Purdie

bitbake: fetch/npmsw: The fetcher shouldn't have any knowledge of S

2024-05-23T10:27:08+00:00

I don't know why there is hardcoded knowledge of S in the fetcher but there shouldn't be and the OE unpack changes highlight this doing things it shouldn't. Drop the S reference and use rootdir which is the only place it should be touching. (Bitbake rev: 84f102954e10a3390fca9c26d5c3c639e952a2c9) Signed-off-by: Richard Purdie

bitbake: fetch2: Add API for upstream source tracing

2023-10-15T08:12:43+00:00

This patch adds an API to bb.fetch2 to enable users to plug in an unpack tracer that can trace each source file back to its corresponding upstream source url, even when multiple upstream sources are combined together in the same unpack directory. This may be required for software composition analysis, license compliance, and detailed SBoM generation. This patch provides only the needed hooks in bb.fetch2 code and a dummy abstract class defining the API; users may load their own unpack tracer class by setting the BB_UNPACK_TRACER_CLASS config parameter. (Bitbake rev: 05051152cc42acc52bcf9af9a696f632fac4307f) Signed-off-by: Alberto Pianon Signed-off-by: Richard Purdie

bitbake: bitbake: fetch2/npmsw: Check if there are dependencies before trying to fetch them

2023-08-04T10:48:26+00:00

When there are no dependencies, _foreach_proxy_method does not verify that there are dependencies to fetch before fetching them. (Bitbake rev: 48a102e49448656ef25fb689af7b0971fde523e3) Signed-off-by: BELOUARGA Mohamed Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie

bitbake: fetch2/npmsw: Support old and new shrinkwrap formats

2023-06-30T08:50:46+00:00

"fetch2/npmsw: Add support for the new format of the shrinkwrap file" added support for the new format shrinkwrap files but this regressed our tests which still use the old format. Similar to how npm handles this, support both for now until we can migrate our tests. (Bitbake rev: 9941b480a0e2a8b57f2ed069cd583f2784394a2b) Signed-off-by: Richard Purdie

bitbake: fetch2/npmsw: Don't fetch dev dependencies when they are not demanded

2023-06-29T10:10:39+00:00

Dev dependencies should not be fetched only if it is specified in the recipe. (Bitbake rev: 224c2bb1fd3f16ac4063dc0eb8ba43eee34ba782) Signed-off-by: BELOUARGA Mohamed Signed-off-by: Richard Purdie

bitbake: fetch2/npmsw: Add support for the new format of the shrinkwrap file

2023-06-29T10:10:39+00:00

Npm is a package manager that has its own manner to handle installation of packages. But it is not yocto friendly, for instance NPM fetch dependencies in the middle of compilation. The shrinkwrap file changed its format over npm versions, but npm does not version this file, so we can use it properly. The actual changes make NPM depencies work with the actual shrinkwrap format. (Bitbake rev: 19b9f7f0f451a636f3fdcdc1bb283ab431ede612) Signed-off-by: BELOUARGA Mohamed Signed-off-by: Richard Purdie