feat(plugin): Refactor NPM plugin
Metadata
Current evaluation
Merged in canonical/craft-parts#719 as 96b33035, refactoring the NPM plugin and fixing #717 by verifying Node.js SHA256 checksums after pull-phase downloads.
Resolution: closed resolved
Reason: PR #719 was approved and merged as commit 96b33035. It also fixed canonical/craft-parts#717 by verifying downloaded Node.js archives' SHA256 checksums.
Evaluated by: mr-cal-bot
No scores available.
Issue body
- [X] Have you signed the [CLA](http://www.ubuntu.com/legal/contributors/)?
-----
This pull request refactors the NPM plugin and contains the following changes:
* npm-node-version option now accepts an NVM-style version identifier
* Move Node.js download to pull commands
* Verify SHA256 checksums after the Node.js download
* Use new-style npm-install commands if `npm` version is newer than ~~8.x~~ 10.x
* Set `NODE_ENV` to production by default
* Add documentation
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Merged in canonical/craft-parts#719 as 96b33035, refactoring the NPM plugin and fixing #717 by verifying Node.js SHA256 checksums after pull-phase downloads. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged canonical/craft-parts#719 as 96b33035, adding NVM-style Node versions, pull-phase downloads, SHA256 verification, updated npm commands, production defaults, and documentation. | |
| qwen/qwen3.6-35b-a3b | — | — | Merged NPM plugin refactoring. Adds NVM-style version support, moves Node.js downloads to pull phase, verifies SHA256 checksums, updates npm-install for v10+, sets NODE_ENV=production, and adds docs. Resolved #717. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged refactoring of the NPM plugin. Updates include NVM-style version support, moving Node.js downloads to the pull phase, SHA256 verification, updated npm commands for v10+, default NODE_ENV=production, and added documentation. Review comments addressed and issue #717 resolved. |
Update history
No update history recorded yet.
Related work
-
Related To:
canonical/craft-parts#717
(confidence 100%)
The PR author identified this as the fix for the missing Node.js checksum verification issue.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #5036 build(deps): bump craft-parts to 1.33.1 | snapcraft | closed | Closed unmerged in favor of canonical/snapcraft#5031, which merged as a24dc3e49 and bumped craft-parts to 1.33.1, making the npm plugin stateless. | |
| #717 NodeJS checksum not being verified after downloading via the npm plugin | craft-parts | closed | Node.js downloads now verify SHA256 checksums via SHASUMS256.txt; the NPM plugin refactor in canonical/craft-parts#719 merged as commit 96b33035. | |
| #844 npm plugin fails on launchpad | craft-parts | closed | Fixed in canonical/craft-parts#845 (commit fab2ecc1) by making npm plugin setup stateless, restoring npm for Launchpad override-builds. | |
| #5031 build(deps): bump craft-parts | snapcraft | merged | Merged PR #5031 as commit a24dc3e49, bumping craft-parts to 1.33.1 to fix npm builds when pull and build run separately. |