twitter/hogan.js — Issue #52: Odd permissions in the package tar.gz file as published to NPM
Author: danfuzz
Created: 2012-02-28 21:35:58+00:00
State: open

Sometime between node-0.6.8 and node-0.6.11, the way NPM untars package files seems to have changed, and I believe this has revealed a latent problem with Hogan's package tar.gz file as published to the NPM registry.

In particular, none of the directories in the archive seem to have the execute permission flag set, which means that, once unpacked, it is impossible to actually read their contents (without altering the permission flags). This didn't bug the old NPM, but the current one will complain when attempting to install Hogan, along these lines:

```
npm ERR! path /tmp/npm-1330464275415/1330464275783-0.16246374556794763/___package.npm/package/bin/hulk
npm ERR! code EACCES
npm ERR! message EACCES, permission denied '/tmp/npm-1330464275415/1330464275783-0.16246374556794763/___package.npm/package/bin/hulk'
```

If you download, untar, and inspect the package file, you can see what's up:

```
$ curl -k -o hogan.tar.gz https://registry.npmjs.org/hogan/-/hogan-1.0.5-dev.tgz
[...]
$ tar xzf hogan.tar.gz
$ ls -alF package/
total 64
drwxrwxr-x 8 ec2-user ec2-user 4096 Feb 28 21:32 ./
drwxr-xr-x 9 ec2-user ec2-user 4096 Feb 28 21:32 ../
drw-rw-r-- 2 ec2-user ec2-user 4096 Jan 28 21:44 bin/
-rw-rw-r-- 1 ec2-user ec2-user 14 Jan 28 21:44 .git_ignore
-rw-rw-r-- 1 ec2-user ec2-user 89 Jan 28 21:44 .gitmodules
drw-rw-r-- 2 ec2-user ec2-user 4096 Jan 28 21:44 lib/
-rw-rw-r-- 1 ec2-user ec2-user 10349 Jan 28 21:44 LICENSE
-rw-rw-r-- 1 ec2-user ec2-user 1324 Jan 28 21:44 Makefile
-rw-rw-r-- 1 ec2-user ec2-user 558 Jan 28 21:44 package.json
-rw-rw-r-- 1 ec2-user ec2-user 2607 Jan 28 21:44 README.md
drw-rw-r-- 4 ec2-user ec2-user 4096 Jan 28 21:44 test/
drw-rw-r-- 2 ec2-user ec2-user 4096 Jan 28 21:44 tools/
drw-rw-r-- 6 ec2-user ec2-user 4096 Jan 28 21:44 web/
drw-rw-r-- 2 ec2-user ec2-user 4096 Jan 28 21:44 wrappers/
$
```

I'd expect all the directories to show up as `drwxrwxr-x`, which is what you'll see in pretty much every other NPM package (or tarball in general for that matter).