Issue 1:
What / Why

Executing npm ci ignores the os field in package.json. This causes platform specific packages like fsevents (macOS-only) to be installed on other platforms (Windows in this case).

When

Every install through npm ci

Where

Packages with the os field specified in package.json

How

Current Behavior

See description

Steps to Reproduce

Run npm init in a new directory on a windows machine

Install a package with a deeply nested optional dependency on fsevents, like webpack: npm i webpack

Notice a package-lock.json is created with an optional dependency on fsevents@1.2.11

Remove node_modules te create a clean CI clone state

Run npm ci

See the installation fail because fsevents is downloaded, installed, and node-gyp is executed as a result.

Expected Behavior

fsevents is skipped as the package is unsupported on Windows.

Who

@pipobscure

@paulmillr

References

fsevents/fsevents#301

Issue 2:
What / Why

npm ci seems to install an optional dependency for the linux os when running on a mac and seems to install the optional dependency for mac when running on linux.

When

$ npm init -y; npm i oax@0.5.25; npm ls; npm ci; npm ls

click to view output of above command

Wrote to /private/tmp/d/package.json:

{

"name": "d",

"version": "1.0.0",

"description": "",

"main": "index.js",

"scripts": {

"test": "echo "Error: no test specified" && exit 1"

},

"keywords": [],

"author": "",

"license": "ISC"

}

oax@0.5.25 postinstall /private/tmp/d/node_modules/oax

node ./postinstall.js

npm notice created a lockfile as package-lock.json. You should commit this file.

npm WARN d@1.0.0 No description

npm WARN d@1.0.0 No repository field.

npm WARN optional SKIPPING OPTIONAL DEPENDENCY: oax-windows-64@0.5.25 (node_modules/oax/node_modules/oax-windows-64):

npm WARN notsup SKIPPING OPTIONAL DEPENDENCY: Unsupported platform for oax-windows-64@0.5.25: wanted {"os":"win32","arch":"x64"} (current: {"os":"darwin","arch":"x64"})

npm WARN optional SKIPPING OPTIONAL DEPENDENCY: oax-linux-64@0.5.25 (node_modules/oax/node_modules/oax-linux-64):

npm WARN notsup SKIPPING OPTIONAL DEPENDENCY: Unsupported platform for oax-linux-64@0.5.25: wanted {"os":"linux","arch":"x64"} (current: {"os":"darwin","arch":"x64"})

oax@0.5.25

added 2 packages and audited 4 packages in 1.1s

found 0 vulnerabilities

d@1.0.0 /private/tmp/d

└─┬ oax@0.5.25

├── oax-darwin@0.5.25

├── UNMET OPTIONAL DEPENDENCY oax-linux-64@0.5.25

└── UNMET OPTIONAL DEPENDENCY oax-windows-64@0.5.25

npm WARN prepare removing existing node_modules/ before installation

oax@0.5.25 postinstall /private/tmp/d/node_modules/oax

node ./postinstall.js

added 3 packages in 0.722s

d@1.0.0 /private/tmp/d

└─┬ oax@0.5.25

├── oax-darwin@0.5.25

├── oax-linux-64@0.5.25

└── UNMET OPTIONAL DEPENDENCY oax-windows-64@0.5.25

Where

n/a

How

Current Behavior

currently it looks like npm ci is broken for optional dependencies which use the os and arch fields of package.json

Steps to Reproduce

$ npm init -y; npm i oax@0.5.25; npm ls; npm ci; npm ls

You should see that npm i works correctly and installs a single optional dependency for oax.

You should also see that npm ci works incorrectly and installs two of the optional dependencies for oax, this should never happen as each optional dependency is targeting a different operating system and architecture, it should be impossible to have more than one of the optional dependencies installed.

Expected Behavior

it should install oax-darwin when running on darwin and should install oax-linux when running on linux

Who

n/a

References

n/a