flatpak/flatpak-builder-tools

flatpak-node-generator fails with sha1 integrity check

Closed this issue · 11 comments

kfiven commented

flatpak-builder version

1.2.0

Linux distribution and version

Ubuntu 20.04

Affected flatpak-builder tool

node/flatpak-node-generator.py

flatpak-builder tool cli args

--no-requests-cache --no-xdg-layout

Source repository URL

https://raw.githubusercontent.com/cinnyapp/cinny/v2.2.0/package-lock.json

Flatpak-builder manifest URL

https://raw.githubusercontent.com/flathub/in.cinny.Cinny/master/in.cinny.Cinny.yml

Description

I have updated my dependency (@matrix-org/olm) and it has sha1 integrity hash now. Now builder seems to be failing when processing that dependency to generate node sources.

Logs: https://github.com/flathub/in.cinny.Cinny/actions/runs/3073712103/jobs/4966018497#step:12:3399

gasinvein commented

It seems like it breaks because the @matrix-org/olm package comes from gitlab registry.

@refi64 I suppose we'll need to support custom registries after all.

gasinvein commented

I think it was working because @matrix-org/olm was pinned to an exact tarball url, not to a registry version.

ajbura commented

ah.. that could be it.

gasinvein commented

@kfiven Didn't you forget to update your flatpak-builder-tools git submodule?

gasinvein commented

Hmm. My guess it's because you're downloading the package-lock.json file alone (thus the generator doesn't see the .npmrc). Try recursively cloning the whole cinnyapp/cinny-desktop git repo instead.

kfiven commented

I also tried https://github.com/kfiven/in.cinny.Cinny/actions/runs/3117132385/jobs/5055566981#step:12:49 downloading .npmrc file along with lock file but still failed. (Could it be that .npmrc has extra info in addition to registry?)

gasinvein commented

@kfiven Just clone the whole repo. It's much easier than cherry-picking files and re-creating correct structure of them. Here, you can pick changes from my fork.

kfiven commented

Cloning the whole repo worked. Thanks!