F43 Change Proposal: Nodejs node_modules path (self contained)

Wiki - https://fedoraproject.org/wiki/Changes/NodejsNodeModulesPath
Discussion thread -
https://discussion.fedoraproject.org/t/f43-change-proposal-nodejs-node-modules-path-self-contained/157324

This is a proposed Change for Fedora Linux.
This document represents a proposed Change. As part of the Changes
process, proposals are publicly announced in order to receive
community feedback. This proposal will only be implemented if approved
by the Fedora Engineering Steering Committee.

== Summary ==
Nodejs needs a new shared stream agnostic installation folder for modules.

== Owner ==
* Name: [[User:tjuhasz| Tomas Juhasz]]
* Email: tjuhasz@redhat.com

* Name: [[User:jstanek| Jan Stanek]]
* Email: jstanek@redhat.com

* Name: [[User:aradchen| Andrei Radchenko]]
* Email: aradchen@redhat.com


== Detailed Description ==
This proposal is a part of a larger effort to improve the way we
package Nodejs for Fedora and RHEL. The other parts are
[[Changes/NodejsAlternativesSystem]] and
[[Changes/NodeJSMetapackages]].

This effort is specifically focused on allowing users to install
'''any supported''' version of Nodejs, without specifying a major
version.
=== Current Nodejs Situation ===
Currently, Fedora's Node.js setup uses a symlink:
`%{_libdir}/node_modules` points to a version-specific folder like
`%{_libdir}/node_modulesXX` (e.g., `%{_libdir}/node_modules20` or
`%{_libdir}/node_modules22`).

Primary motivation for change is an ongoing effort to de-bundle
certain parts of Node.js, particularly NPM packages that include
pre-built WebAssembly (WASM) binary blobs.

With multiple Nodejs versions present in Fedora, and upstream
recommendations against globally shared NPM packages in consideration,
we need a better way to store these de-bundled packages which could be
shared between multiple streams.
=== Suggested Change ===
Proposed way of doing this is to change `%{_libdir}/node_modules` from
a symlink to a static shared folder.

This static `%{_libdir}/node_modules` path will be used for
version-agnostic modules that can be shared across multiple Nodejs
versions.

For version-specific dependencies, the existing
`%{_libdir}/node_modulesXX` folders (e.g.,
`%{_libdir}/node_modules20`, `%{_libdir}/node_modules22`) will
continue to be used.

=== Alternative path options ===
If the change of `%{_libdir}/node_modules` from a symlink to a shared
folder is not agreeable a alternative path could also be used for the
same purpose e.g.:
* <code>%{_libdir}/nodejs/packages/shared</code> for NPM packages that
can be shared between multiple NodeJS major versions. This should be
the default path for the unbundled packages unless a stream is
identified to need a specific version.
* <code>%{_libdir}/nodejs/packages/<major_version></code> for NPM
packages that are specifically used by a single NodeJS major version.
Reserved for compat-style packages.

Packages installed in these paths are assumed to be used by a
non-npm-related loading mechanism; for NodeJS specifically, via the
"Shared builtins" mechanism
([https://github.com/nodejs/node/blob/main/BUILDING.md#building-to-use-shared-dependencies-at-runtime
upstream docs]).

== Feedback ==


== Benefit to Fedora ==
By having downstream-standartized path for "Shared builtins" modules,
we can start removing potentially unsafe pre-build WASM (binary) blobs
from the NodeJS sources, rebuilding them on our infrastructure from
trusted sources.

Accommodating single default shared directory will reduce work
necessary for unbundling the packages from several NodeJS major
versions at once, while the preservation of version-specific paths
will allow for compatibility packages where necessary.

== Scope ==
* Proposal owners: Adding a small `%pretrans` scriptlet for turning
`/usr/lib/node_modules` into a separate directory in all active nodejs
streams

* Other developers: Any developers who package npm packages will need
to verify, that their RPM will be functional after the
`%{_libdir}/node_modules` will change from a symlink to a folder and
if necessary rebuild their packages so that the files are present in
`%{_libdir}/node_modules` and rather then in e.g.
`%{_libdir}/node_modules_22`.
* Release engineering: N/A

* Policies and guidelines: N/A.

* Trademark approval: N/A (not needed for this Change)

* Alignment with the Fedora Strategy:


== Upgrade/compatibility impact ==
There should be no need for manual intervention.



== Early Testing (Optional) ==


== How To Test ==
Allow to install nodejs dependencies like `nodejs-cjs-module-lexer`
into a shared static folder.

== User Experience ==
User experience should not be affected in any way.

== Dependencies ==
None


== Contingency Plan ==
* Contingency mechanism: Reverting the change back to using
`%{_libdir}/node_modules` as a symlink pointing to version specific
folders.
* Contingency deadline: N/A
* Block release: N/A


== Documentation ==
This Page.

== Release Notes ==


--
Aoife Moloney

Fedora Operations Architect

Fedora Project

Matrix: @amoloney:fedora.im

IRC: amoloney

--
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/devel-announce@lists.fedoraproject.org
Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue