4 ms·

I thought further up it mentioned that it starts with the permissions of the files in the tarball, then grabs process.umask (of the npm-tarball subprocess maybe

by varikin 10y ago

I thought further up it mentioned that it starts with the permissions of the files in the tarball, then grabs process.umask (of the npm-tarball subprocess maybe?) and then overrides the execute bit. If that is correct, that is 2 layers of questionable permissions being applied leading to non-deterministicness.

tyingq 10y ago
Perhaps, but the author of the comment I quoted seemed to be performing the install over and over, on the same machine. I assume neither the tarball permissions nor the umask would be changing, so it's odd.
- varikin 10y ago
  Well that further complicates it.
  - jacquesm 10y ago
    Does it fork off any background processes? If so that would be the first place to look, the code executing in parallel with the main program.
kpcyrd 10y ago
This bug was rediscovered 1 year later after a distro shipped a package with /usr/lib/node_modules/ being set to 777 in a deterministic build environment. This seems to be a race condition since it may or may not happen on multiple rebuilds.