https://bugzilla.redhat.com/show_bug.cgi?id=2491084

https://bugzilla.redhat.com/show_bug.cgi?id=2491085

https://bugzilla.redhat.com/show_bug.cgi?id=2491086

https://bugzilla.redhat.com/show_bug.cgi?id=2491087

https://bugzilla.redhat.com/show_bug.cgi?id=2491088

I've started work to illustrate some of the changes that will be required, here:

https://codeberg.org/gordonmessmer/nodejs-undici/compare/rawhide...strip-node-modules

... but the process of stripping executable binaries probably belongs in nodejs-packaging-bundler, not in individual package "sources.sh" scripts

Re. the main subject of the FESCo ticket, I think that prebuilt binaries should be removed from npm vendor archives before they are created and uploaded to the lookaside cache, but the Guidelines don't strictly require this as far as I understand them. https://docs.fedoraproject.org/en-US/packaging-guidelines/what-can-be-packaged/#prebuilt-binaries-or-libraries only says that they need to be removed in %prep and not used during the build process (as opposed to legally problematic content which is not allowed to be uploaded at all).

If these packages (it would be helpful to have a list of package names in this ticket addition to the bugzillas that people have to click through) are not removing the prebuilt binaries during %prep, either, then yes, that's something that the package maintainers need to address/fix. If that doesn't happen in a reasonable amount of time, FESCo can decide to orphan or retire them.

Re. general issues with NodeJS packaging in Fedora, I have more to say here and agree with the sentiment on the devel thread that there's not enough tooling or guidance or Guidelines to properly package "web stuff" In Fedora. There were efforts to change the Guidelines in https://pagure.io/fesco/issue/3177 but that introduced new problems (https://forge.fedoraproject.org/packaging/guidelines/issues/1496). So this is something that FESCo and/or the FPC need to discuss (in a separate ticket, probably).

it would be helpful to have a list of package names in this ticket addition to the bugzillas that people have to click through

• openclaw
• nodejs-undici
• nodejs-postcss-url
• nodejs-aw-webui
• magicmirror

@gordonmessmer, is this supposed to be an exhaustive list of packages with this issue or are there potentially others?

It's probably a complete list, but I built it by getting the "all specs" archive, looking for specs that reference "nm-prod.tgz" or "nm-dev.tgz", cloning those repositories, fetching their source archives with fedpkg, extracting those, and then:

find */node_modules* -type f -print | file --mime-type -N -f - | grep -E ': (application/x-executable|application/vnd.microsoft.portable-executable|application/x-mach-binary|application/wasm)$'

the Guidelines don't strictly require this as far as I understand them

Yeah, that makes sense. I was thinking that if we wanted this to be done consistently, then it probably should be part of the bundler, but we could also provide a macro for %prep and require nodejs packages to use it.