{"action":"created","issue":{"url":"https://api.github.com/repos/mozilla/kitsune/issues/2419","labels_url":"https://api.github.com/repos/mozilla/kitsune/issues/2419/labels{/name}","comments_url":"https://api.github.com/repos/mozilla/kitsune/issues/2419/comments","events_url":"https://api.github.com/repos/mozilla/kitsune/issues/2419/events","html_url":"https://github.com/mozilla/kitsune/pull/2419","id":62503697,"number":2419,"title":"Use npm-lockdown to install Node dependencies","user":{"login":"rehandalal","id":987136,"avatar_url":"https://avatars.githubusercontent.com/u/987136?v=3","gravatar_id":"","url":"https://api.github.com/users/rehandalal","html_url":"https://github.com/rehandalal","followers_url":"https://api.github.com/users/rehandalal/followers","following_url":"https://api.github.com/users/rehandalal/following{/other_user}","gists_url":"https://api.github.com/users/rehandalal/gists{/gist_id}","starred_url":"https://api.github.com/users/rehandalal/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rehandalal/subscriptions","organizations_url":"https://api.github.com/users/rehandalal/orgs","repos_url":"https://api.github.com/users/rehandalal/repos","events_url":"https://api.github.com/users/rehandalal/events{/privacy}","received_events_url":"https://api.github.com/users/rehandalal/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2015-03-17T19:59:41Z","updated_at":"2015-03-17T21:45:16Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/mozilla/kitsune/pulls/2419","html_url":"https://github.com/mozilla/kitsune/pull/2419","diff_url":"https://github.com/mozilla/kitsune/pull/2419.diff","patch_url":"https://github.com/mozilla/kitsune/pull/2419.patch"},"body":"r?"},"comment":{"url":"https://api.github.com/repos/mozilla/kitsune/issues/comments/82610780","html_url":"https://github.com/mozilla/kitsune/pull/2419#issuecomment-82610780","issue_url":"https://api.github.com/repos/mozilla/kitsune/issues/2419","id":82610780,"user":{"login":"mythmon","id":305049,"avatar_url":"https://avatars.githubusercontent.com/u/305049?v=3","gravatar_id":"","url":"https://api.github.com/users/mythmon","html_url":"https://github.com/mythmon","followers_url":"https://api.github.com/users/mythmon/followers","following_url":"https://api.github.com/users/mythmon/following{/other_user}","gists_url":"https://api.github.com/users/mythmon/gists{/gist_id}","starred_url":"https://api.github.com/users/mythmon/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mythmon/subscriptions","organizations_url":"https://api.github.com/users/mythmon/orgs","repos_url":"https://api.github.com/users/mythmon/repos","events_url":"https://api.github.com/users/mythmon/events{/privacy}","received_events_url":"https://api.github.com/users/mythmon/received_events","type":"User","site_admin":false},"created_at":"2015-03-17T21:45:16Z","updated_at":"2015-03-17T21:45:16Z","body":"Wow, we have a lot of node dependencies from all our dependencies' dependencies.\r\n\r\nI tested what happens if a hash is bad or missing. In both cases I got this:\r\n\r\n```$ npm install\r\n> Kitsune@ preinstall /home/mythmon/src/kitsune\r\n> ./scripts/lockdown.js\r\n\r\nNPM Lockdown is here to check your dependencies!  Never fear!\r\nusing registry: registry.npmjs.org\r\n\r\n> Kitsune@ preinstall /home/mythmon/src/kitsune\r\n> ./scripts/lockdown.js\r\n\r\nnpm WARN optional dep failed, continuing fsevents@0.2.1\r\nnpm ERR! Linux 3.18.6-1-ARCH\r\nnpm ERR! argv \"/usr/bin/node\" \"/usr/bin/npm\" \"install\"\r\nnpm ERR! node v0.10.36\r\nnpm ERR! npm  v2.5.0\r\nnpm ERR! code ETARGET\r\n\r\nnpm ERR! notarget No compatible version found: abbrev@'>=1.0.0 <2.0.0'\r\nnpm ERR! notarget No valid targets found.\r\nnpm ERR! notarget Perhaps not compatible with your version of node?\r\nnpm ERR! notarget This is most likely not a problem with npm itself.\r\nnpm ERR! notarget In most cases you or one of your dependencies are requesting\r\nnpm ERR! notarget a package version that doesn't exist.\r\n\r\nnpm ERR! Please include the following file with any support request:\r\nnpm ERR!     /home/mythmon/src/kitsune/npm-debug.log\r\n\r\nnpm ERR! Linux 3.18.6-1-ARCH\r\nnpm ERR! argv \"/usr/bin/node\" \"/usr/bin/npm\" \"install\"\r\nnpm ERR! node v0.10.36\r\nnpm ERR! npm  v2.5.0\r\nnpm ERR! code ELIFECYCLE\r\nnpm ERR! Kitsune@ preinstall: `./scripts/lockdown.js`\r\nnpm ERR! Exit status 1\r\nnpm ERR! \r\nnpm ERR! Failed at the Kitsune@ preinstall script './scripts/lockdown.js'.\r\nnpm ERR! This is most likely a problem with the Kitsune package,\r\nnpm ERR! not with npm itself.\r\nnpm ERR! Tell the author that this fails on your system:\r\nnpm ERR!     ./scripts/lockdown.js\r\nnpm ERR! You can get their info via:\r\nnpm ERR!     npm owner ls Kitsune\r\nnpm ERR! There is likely additional logging output above.\r\n\r\nnpm ERR! Please include the following file with any support request:\r\nnpm ERR!     /home/mythmon/src/kitsune/npm-debug.log\r\n```\r\n\r\nThis also returned an exit code of 1, which means it will fail in Travis and in deploy, which is good. It is a bit confusing though, so we should add it to the docs. We should also add a note about how to add new dependencies to the docs.\r\n\r\nBesides the doc changes, I think everything looks good."}}