Picking a different version of NPM in an offline environment requires the Internet about nodejs-buildpack

[cf-gitbot]

We have created an issue in Pivotal Tracker to manage this. You can view the current status of your issue at: https://www.pivotaltracker.com/story/show/116037317.

[Dannyzen]

@dmikusa-pivotal thanks for putting in this issue. We're curious as to what you perceive expected behavior to be in this use case.

[dmikusa]

Well given that it's an offline / cached build pack, I would not expect it to try to access the Internet, which it's doing. I say that the build pack is doing this not NPM because it's the build pack that's executing an NPM command that has no hope of succeeding without Internet access.

I'm not sure exactly what the right behavior is here, but it shouldn't be to try accessing the Internet as that's a guaranteed failure in an offline environment.

I can see a couple different possibilities for handling this nicer when the build pack is in offline mode. For either case it basically involves not allowing the user to select a custom version of NPM (a case we can detect).

The first option, if the user tried to select a custom version of NPM, we would log an error and print a clear message to the user saying that we cannot accommodate the request for a custom NPM version as it would require access to the internet to install that version of NPM. Linking to a doc that explains more would be helpful, then we could fully explain the customer's options (like how to remove custom NPM version or how to use an online build pack with an HTTP_PROXY).

The second option would be to simply skip installing the requested version and produce a big warning message that says you're not getting the version of NPM you selected because we're in offline mode and it requires the Internet to download and install that version of NPM. Again, a link to the docs with more info on this would be helpful too.

I'm open to other suggestions as well. Those were just the first two that came to mind.

[flavorjones]

I agree. If it needs to hit the internet, I'd expect us to emit a not-in-the-manifest error similar to what happens if I specify an unavailable version of node.

[jvshahid]

Just few clarifications. the buildpack doesn't have npm in the manifest. It simply uses the npm that is packaged with the version of node you specify in the package.json file. I believe heroku added this feature to their buildpack since npm prior to 2.1.x had major bugs in them. The only version of node that ships with such an old version of npm are the 0.10.x. Related to the previous note, I think it is better to print a warning if the npm version doesn't match the one bundled with nodejs. Erroring out has the potential of breaking "many" apps which relied on this behavior.

[jvshahid]

A pointer to heroku's documentation: https://devcenter.heroku.com/articles/nodejs-support#specifying-an-npm-version

[jvshahid]

Sent a cf-dev proposal to change the buildpack behavior. the new behavior will be to not allow developers to change the version of npm. as a developer you can only use the version of npm that is shipped with the version of nodejs you chose. You can find the discussion here: https://lists.cloudfoundry.org/archives/list/[email protected]/thread/ZRSOFXISIR4PHWIRFN4RABBRAGE42VZR/

[jvshahid]

@flavorjones do you still have strong opinions about this behavior given the feedback that we got in the mailing list and here ?

[flavorjones]

@jvshahid I never had a strong opinion about this, but it's not clear what the proposal is we're currently considering. Can you summarize here?

[jvshahid]

Modify the buildpack to not download a different version of npm if it isn't specified in package.json. Also, modify the documentation to clearly states that you shouldn't specify npm version in package.json if you are in an offline environment.

[tomoe]

@jvshahid

modify the documentation to clearly states that you shouldn't specify npm version in package.json if you are in an offline environment.

I would also like to see an error message logged and printed out to the user as @dmikusa-pivotal suggested in #54 (comment)

[Dannyzen]

There's quite a few different issues & stories related to this originating issue. The below describes the actions the team will take:

• Document that custom versions of npm, in an offline environment are not supported
• Add a test to make sure that if no version of npm is selected, we use the default version that comes with node and no internet traffic attempts are made
  work will be done on: https://www.pivotaltracker.com/story/show/118775597

[Dannyzen]

This work has been completed on: https://www.pivotaltracker.com/story/show/118775597