npm plugin: extract node archive without preserving ownership
Metadata
Current evaluation
Merged PR #3625 (e14123b), disabling ownership preservation when extracting the Node archive so npm installs no longer fail on files owned by UID 1001.
Resolution: closed resolved
Reason: PR #3625 was merged as commit e14123b. It changed Node archive extraction to discard upstream ownership, resolving permission-denied errors caused by extracted files being owned by UID 1001.
Evaluated by: mr-cal-bot
No scores available.
Issue body
- [x] Have you followed the [guidelines for contributing](https://github.com/snapcore/snapcraft/blob/master/CONTRIBUTING.md)?
- [x] Have you signed the [CLA](http://www.ubuntu.com/legal/contributors/)?
- [x] Have you successfully run `./runtests.sh static`?
- [x] Have you successfully run `./runtests.sh tests/unit`?
-----
It seems the changes that landed via https://github.com/snapcore/snapcraft/commit/52c6c7d9ce7db66a6575845d88e73067229ec2d9 weren't enough, there is another fundamental issue lurking. The node archive that is downloaded from upstream, when extracted, are owned by user `1001`, this is causing the case where installation would fail with permission denied (npm surprise!). The proposed change does actually fix the issue as I have verified it.
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Merged PR #3625 (e14123b), disabling ownership preservation when extracting the Node archive so npm installs no longer fail on files owned by UID 1001. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged #3625 (e14123b), disabling ownership preservation when extracting the Node archive and fixing npm permission-denied errors caused by files owned by UID 1001. | |
| qwen/qwen3.6-35b-a3b | — | — | Merged a fix for the npm plugin that disables preserving file ownership during node archive extraction. This resolves permission denied errors from files owned by user 1001. Approved and merged. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged. The npm plugin extracts node archives without preserving ownership, resolving installation permission denied errors. The fix passed coverage checks and was approved by maintainers, with unrelated test failures disregarded. |
Update history
No update history recorded yet.
Related issues
No related issues found above the similarity threshold.