"npm install -g" misusing DESTDIR for dependency lookup

What I Wanted to Do

DESTDIR=/path/to/buildroot npm install -g brace-expansion-1.1.11.tgz should install new modules to the npm global prefix under /path/to/buildroot. It should not be fetching and installing dependencies to the same buildroot if they already exist under the global prefix (without DESTDIR).

Example: I tried DESTDIR=/path/to/buildroot npm install -g brace-expansion-1.1.11.tgz with dependencies (balanced-match and concat-map) already present in /usr/lib/node_modules/. This should simply unpack brace-expansion package content under /path/to/buildroot/usr/lib/node_modules/brace-expansion/, and nothing more.

What Happened Instead

npm is fetching and installing balanced-match and concat-map under /path/to/buildroot/usr/lib/node_modules/brace-expansion/node_modules/. I suspect it would do the same any time a package.json lists anything under dependencies.

Or, alternatively, DESTDIR=/path/to/buildroot npm list -g --depth=0 is trying to look up installed packages under /path/to/buildroot, rather than under the real installed system.

Details

I’m not sure why npm is using DESTDIR this way, but it is unnecessary and misunderstands the intended use of DESTDIR. DESTDIR is supposed to affect where new files are installed, not where to search for active preinstalled dependencies. For people like me building .deb or .rpm packages, this makes npm install unusable for any package with run-time dependencies; it requires network fetch operations and pollutes the resulting package with redundant extra modules.

Reproduction Steps

See above. Cloning the current brace-expansion source tree and running “npm pack $PWD” within it should produce a suitable .tgz to test with.

Platform Info

ivaldi@macchiato:~ $ npm --versions
{ npm: '6.9.0',
  ares: '1.15.0',
  cldr: '33.1',
  http_parser: '2.8.0',
  icu: '62.1',
  modules: '64',
  napi: '3',
  nghttp2: '1.37.0',
  node: '10.15.3',
  openssl: '1.1.0j',
  tz: '2018e',
  unicode: '11.0',
  uv: '1.26.0',
  v8: '6.8.275.32-node.51',
  zlib: '1.2.11' }
ivaldi@macchiato:~ $ node -p process.platform
linux
ivaldi@macchiato:~ $ uname -a
Linux macchiato 4.16.18 #1 SMP PREEMPT Mon Oct 1 01:01:58 CDT 2018 aarch64 GNU/Linux

This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.