nodejs-packaging-bundler: optionally use a local tarball instead of npm

README.md

@@ -152,11 +152,11 @@ For more detailed packaging information go to the
 ## Bundling Script
 
 ```
-nodejs-packaging-bundler <npm_name> [version]
+nodejs-packaging-bundler <npm_name> [version] [tarball]
 ```
 
 nodejs-packaging-bundler is it's own package, nodejs-packaging-bundler and must be installed before use.  
-nodejs-packaging-bundler gets the latest npm version available, if no version is given.  
+nodejs-packaging-bundler gets the latest npm version available, if no version is given, or uses the existing tarball if one is given. Using npm is preferred for to ease reproducibility. If a local tarball is required (e.g. because the package is missing from npm or its version is too old), please ensure to document how the tarball was created.
 It produces four files and puts them in ${HOME}/rpmbuild/SOURCES
 
  * <npm_name>-<version>.tgz - This is the tarball from npm.org

nodejs-packaging-bundler

@@ -2,13 +2,14 @@
 OUTPUT_DIR="$(rpm -E '%{_sourcedir}')"
 
 usage() {
-  echo "Usage `basename $0` <npm_name> [version] " >&2
+  echo "Usage `basename $0` <npm_name> [version] [tarball]" >&2
   echo >&2
   echo "  Given a npm module name, and optionally a version," >&2
   echo "    download the npm, the prod and dev dependencies," >&2
   echo "    each in their own tarball." >&2
   echo "    Also finds licenses prod dependencies." >&2
   echo "  All three tarballs and the license list are copied to ${OUTPUT_DIR}" >&2
+  echo "  If a tarball is passed, use that instead of downloading from npm" >&2
   echo >&2
   exit 1
 }
@@ -38,6 +39,9 @@ fi
 
 if [ $# -ge 2 ]; then 
   VERSION="$2"
+  if [ $# -ge 3 ]; then
+    TARBALL="$(realpath "$3")"
+  fi
 else
   VERSION="$(npm view ${PACKAGE} version)"
 fi 
@@ -47,7 +51,17 @@ TMP_DIR=$(mktemp -d -t ci-XXXXXXXXXX)
 mkdir -p ${OUTPUT_DIR}
 mkdir -p ${TMP_DIR}
 pushd ${TMP_DIR}
+if [ -f "$TARBALL" ]; then
+  TARBALL_DIR=$(mktemp -d -t ci-XXXXXXXXXX)
+  pushd ${TARBALL_DIR}
+  tar xfz ${TARBALL} --strip-components 1
+  npm pack .
+  popd > /dev/null
+  mv ${TARBALL_DIR}/*.tgz .
+  rm -rf ${TARBALL_DIR}
+else
   npm pack ${PACKAGE}
+fi
 tar xfz *.tgz
 cd package
 echo " Downloading prod dependencies"

nodejs-packaging.spec

@@ -2,7 +2,7 @@
 
 Name:           nodejs-packaging
 Version:        2021.06
-Release:        4%{?dist}
+Release:        5%{?dist}
 Summary:        RPM Macros and Utilities for Node.js Packaging
 BuildArch:      noarch
 License:        MIT
@@ -84,6 +84,9 @@ install -Dpm0755 nodejs-packaging-bundler %{buildroot}%{_bindir}/nodejs-packagin
 
 
 %changelog
+* Sun May 01 2022 Davide Cavalca <dcavalca@fedoraproject.org> - 2021.06-5
+- NPM bundler: optionally use a local tarball instead of npm
+
 * Thu Jan 20 2022 Stephen Gallagher <sgallagh@redhat.com> - 2021.06-4
 - NPM bundler: also find namespaced bundled dependencies