npm: set npm_config_build_from_source=true to handle prebuildify packages by Gitjay11 · Pull Request #1392 · hermetoproject/hermeto

Gitjay11 · 2026-03-12T13:10:25Z

Description

Resolves the first proposed solution from #1015.

Packages using prebuildify ship precompiled native .node binaries under a prebuilds/ directory. At install time, node-gyp-build checks for the npm_config_build_from_source environment variable — if set, it compiles native addons from source instead of using the prebuilt binaries.

Without this fix, hermetic builds silently use prebuilt platform-specific binaries, undermining the hermetic build guarantee.

This PR injects npm_config_build_from_source=true into the build configuration output for all npm packages, ensuring native addons are always compiled from source.

How to test

nox -s python-3.10 -- tests/unit/package_managers/test_npm.py -v

============================= test session starts ==============================
collected 105 items

tests/unit/package_managers/test_npm.py::test_fetch_npm_source[single_input_package] PASSED
tests/unit/package_managers/test_npm.py::test_fetch_npm_source[multiple_input_package] PASSED
...
============================= 105 passed in 1.54s ==============================

As noted in the issue, we should do either or both of the proposed solutions. This PR implements Solution 1 as a standalone fix. Solution 2 (detecting and gating prebuilt packages) can be added as a follow-up PR if the maintainers agree it's needed.

gemini-code-assist

Code Review

This pull request correctly adds the npm_config_build_from_source=true environment variable to force npm to build native addons from source, which is a good step towards ensuring hermetic builds. My review includes a couple of suggestions to improve code maintainability by reducing magic strings and code duplication in tests, in line with the repository's style guide.

gemini-code-assist

Code Review

This pull request correctly implements the proposed solution to force npm packages with native addons to be built from source by setting the npm_config_build_from_source environment variable. This is a good improvement for ensuring hermetic builds.

I've added a couple of suggestions to improve maintainability by reducing the use of magic strings and avoiding code duplication in tests, in line with the repository's style guide.

gemini-code-assist · 2026-03-12T13:13:02Z

+    env_vars = [
+        EnvironmentVariable(
+            name="npm_config_build_from_source",
+            value="true",
+        ),
+    ]


To improve readability and maintainability, it's better to define hardcoded strings like environment variable names as module-level constants. This avoids magic strings and makes the configuration easier to manage.

You could add the following at the top of the file:

NPM_BUILD_FROM_SOURCE_ENV_VAR = "npm_config_build_from_source"

And then use it here:

env_vars = [ EnvironmentVariable( name=NPM_BUILD_FROM_SOURCE_ENV_VAR, value="true", ), ]

References

The style guide emphasizes maintaining readable code. ^(link)

gemini-code-assist · 2026-03-12T13:13:02Z

+                "environment_variables": [
+                    EnvironmentVariable(
+                        name="npm_config_build_from_source",
+                        value="true",
+                    ),
+                ],


There's some code duplication here and in the next test case (lines 889-894) for creating the EnvironmentVariable object. The repository style guide encourages reducing code duplication.

To follow the DRY (Don't Repeat Yourself) principle, you could define this as a constant at the top of the test file or within the test class and reuse it in both parameterized tests.

For example:

BUILD_FROM_SOURCE_ENV_VAR = EnvironmentVariable( name="npm_config_build_from_source", value="true", ) # ... inside the test parameterization "environment_variables": [BUILD_FROM_SOURCE_ENV_VAR],

References

The style guide recommends detecting and flagging code duplication. ^(link)

farhann-saleem · 2026-03-12T21:43:21Z


+    env_vars = [
+        EnvironmentVariable(
+            name="npm_config_build_from_source",


When this triggers node-gyp, won't it try to fetch Node.js headers from nodejs.org at build time?
How would that work in a hermetic/offline build?

Actually when node-gyp compiles from source, it needs Node.js C/C++ headers. However node-gyp first checks for locally available headers (via the Node.js installations include/ directory or the npm_config_nodedir env var) before attempting to download from nodejs.org. In typical hermetic build environments (e.g., Konflux), Node.js is pre-installed in the base image with headers already available, so node-gyp finds them locally without needing network access.
well, happy to add a note in the code or docs if it's needed.

farhann-saleem

Does yarn / yarn-classic need the same treatment? node-gyp-build checks this env var regardless of the package manager.

a-ovchinnikov · 2026-03-12T21:59:22Z

I'd say second option is necessary since it adds visibility. Users who are fine with binaries could then set the variable to true then.

Gitjay11 · 2026-03-13T06:20:32Z

@farhann-saleem Yes, that's right. node-gyp-build checks this env var regardless of the package manager. I'll update this PR to add the same env var to yarn and yarn-classic as well.

edit : I have added the changes now.

Gitjay11 · 2026-03-13T06:25:34Z

@a-ovchinnikov Yeah, I know solution 2 adds important visibility. This PR was scoped to Solution 1 as a minimal first step since the issue says either or both. I will implement Solution 2 soon and raise a follow-up PR for it.

edit: I have raised a follow up PR for solution 2.

eskultety · 2026-06-30T14:09:47Z

@Gitjay11 are you going to still work on this? There are merge conflicts to resolve.

Gitjay11 · 2026-07-02T00:57:01Z

@Gitjay11 are you going to still work on this? There are merge conflicts to resolve.

@eskultety yes, I have resolved the conflicts.

…ages (hermetoproject#1015) Signed-off-by: Gitjay11 <newajay.11r@gmail.com> Assisted-by: Gemini

 import pytest

 from hermeto import APP_NAME
+from hermeto.core.models.output import EnvironmentVariable, RequestOutput


slimreaper35 · 2026-07-02T12:12:49Z

+@mock.patch(
+    "hermeto.core.package_managers.javascript.npm.main.create_backend_annotation",
+    return_value=None,
+)
+@mock.patch("hermeto.core.package_managers.javascript.npm.main._resolve_npm")
+def test_fetch_npm_source_sets_build_from_source_env_var(


I think this unit test is in contradiction with what we are trying to do in #1588

gemini-code-assist Bot reviewed Mar 12, 2026

View reviewed changes

Comment thread hermeto/core/package_managers/npm.py Outdated

Comment thread tests/unit/package_managers/test_npm.py Outdated

gemini-code-assist Bot reviewed Mar 12, 2026

View reviewed changes

farhann-saleem reviewed Mar 12, 2026

View reviewed changes

Gitjay11 force-pushed the issue-1015-npm-prebuildify-build-from-source branch 2 times, most recently from bb390b7 to 222c0bc Compare March 15, 2026 04:36

Gitjay11 mentioned this pull request Mar 16, 2026

feat(npm): detect prebuilt binaries and gate them behind binary/allow_binary field #1415

Closed

npm: set npm_config_build_from_source=true to handle prebuildify pack…

ddf4012

…ages (hermetoproject#1015) Signed-off-by: Gitjay11 <newajay.11r@gmail.com> Assisted-by: Gemini

Gitjay11 force-pushed the issue-1015-npm-prebuildify-build-from-source branch from 222c0bc to ddf4012 Compare July 2, 2026 01:14

github-advanced-security AI found potential problems Jul 2, 2026

View reviewed changes

Comment thread tests/unit/package_managers/javascript/npm/test_main.py

import pytest

from hermeto import APP_NAME

from hermeto.core.models.output import EnvironmentVariable, RequestOutput

slimreaper35 reviewed Jul 2, 2026

View reviewed changes

Uh oh!

Conversation

Gitjay11 commented Mar 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

How to test

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist Bot Mar 12, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot Mar 12, 2026

Choose a reason for hiding this comment

Uh oh!

farhann-saleem Mar 12, 2026

Choose a reason for hiding this comment

Uh oh!

Gitjay11 Mar 13, 2026

Choose a reason for hiding this comment

Uh oh!

farhann-saleem left a comment

Choose a reason for hiding this comment

Uh oh!

a-ovchinnikov commented Mar 12, 2026

Uh oh!

Gitjay11 commented Mar 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Gitjay11 commented Mar 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

eskultety commented Jun 30, 2026

Uh oh!

Gitjay11 commented Jul 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

slimreaper35 Jul 2, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

6 participants

Gitjay11 commented Mar 12, 2026 •

edited

Loading

Gitjay11 commented Mar 13, 2026 •

edited

Loading

Gitjay11 commented Mar 13, 2026 •

edited

Loading

Gitjay11 commented Jul 2, 2026 •

edited

Loading