src/package.json file is modified when starting etherpad

[RalfJung]

Steps to reproduce

I am launching etherpad directly from the clone source tree by starting bin/run.sh, with NODE_ENV=production in the environment.

Actual behavior

After doing that, git status tells me that src/package.json has been modified. From the looks of it, something parsed and re-formatted the json in there.

Expected behavior

Launching an application should not modify source files that are tracked by the VCS. Hence I would expect git status to be clean after launching etherpad.

[muxator]

@RalfJung, that's true. After googling around, it appears to be standard (albeit surprising) behaviour on npm side. The command that triggers reformatting is npm install --loglevel warn.

The npm developers do not seem to be willing to change that (see npm/npm#3299), so probably in order to mitigate this issue, a different approach will be needed.

Personally, I do not see a reason for which a config file needs to be opened RW at all.

[RalfJung]

npm/npm#3299 seems to be about "npm shorthands for updating your JSON". Is etherpad using those when being started, or how is that related?

[muxator]

You are right, @RalfJung, wrong link.

It turns out, at some point of its development npm default config for save was changed to true. This means that if you have a newer npm version and you use the default config, npm will rewrite package.json on installation.

This makes no sense for installDeps.sh, because its only (big) side effect should be to actually install dependencies according to a configuration file, and not to modify it.

I have made some tests, and to fix this it is possible to add --no-save to the npm command line in installDeps.sh. No concerns about backwards compatiblity with oldish npm version, as they seem to support --no-XXX style flags even if not documented.

[RalfJung]

Thanks :)

[muxator]

I am going to revert my decision and put back --save in installDeps.sh. For the motivations, see #3659.

In the meantime, the committed version of package.json was reformatted (see c4918ef and subsequent commits), so at least any change on that file will be easily identifiable looking at the diff.