{"action":"created","issue":{"url":"https://api.github.com/repos/joyent/node-http-signature/issues/51","labels_url":"https://api.github.com/repos/joyent/node-http-signature/issues/51/labels{/name}","comments_url":"https://api.github.com/repos/joyent/node-http-signature/issues/51/comments","events_url":"https://api.github.com/repos/joyent/node-http-signature/issues/51/events","html_url":"https://github.com/joyent/node-http-signature/issues/51","id":117577456,"number":51,"title":"Remove the sshpk from peerDependencies","user":{"login":"IgorAufricht","id":13379857,"avatar_url":"https://avatars.githubusercontent.com/u/13379857?v=3","gravatar_id":"","url":"https://api.github.com/users/IgorAufricht","html_url":"https://github.com/IgorAufricht","followers_url":"https://api.github.com/users/IgorAufricht/followers","following_url":"https://api.github.com/users/IgorAufricht/following{/other_user}","gists_url":"https://api.github.com/users/IgorAufricht/gists{/gist_id}","starred_url":"https://api.github.com/users/IgorAufricht/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/IgorAufricht/subscriptions","organizations_url":"https://api.github.com/users/IgorAufricht/orgs","repos_url":"https://api.github.com/users/IgorAufricht/repos","events_url":"https://api.github.com/users/IgorAufricht/events{/privacy}","received_events_url":"https://api.github.com/users/IgorAufricht/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":7,"created_at":"2015-11-18T12:35:23Z","updated_at":"2015-11-18T20:23:01Z","closed_at":null,"body":"http-signature doesn't play well with `npm prune` and `npm shrinkwrap` when using `npm@2`. The reason for this is the `sshpk` dependency in `peerDependencies`:\r\n```\r\n  \"dependencies\": {\r\n    \"assert-plus\": \"^0.1.5\",\r\n    \"jsprim\": \"^1.2.2\",\r\n    \"sshpk\": \"^1.4.6\"\r\n  },\r\n  \"peerDependencies\": {\r\n    \"sshpk\": \"^1.4.6\"   <- this\r\n  },\r\n```\r\n\r\n\r\nHow to reproduce the problem:\r\n\r\n1. create a `package.json` file like this:\r\n```\r\n{\r\n  \"dependencies\": {\r\n    \"http-signature\": \"~1.0.2\"\r\n  }\r\n}\r\n```\r\n2. run `npm install` (use `npm@2`, I used 2.14.0)\r\n3. runing `npm shrinkwrap` fails:\r\n```\r\nnpm ERR! extraneous: sshpk@1.6.2 c:\\dev\\labs\\http-signature-test\\node_modules\\sshpk\r\n```\r\n4. running `npm prune` and then `npm shrinkwrap` results in `npm prune` unbuilding the peer dependency and `npm shrinkwrap` failing:\r\n```\r\nnpm ERR! missing: sshpk@^1.4.6, required by http-signature@1.0.2\r\n```\r\n\r\n**I propose to remove `sshpk` from `peerDependencies`, since it is already specified in `dependencies`.**\r\n\r\n(`sshpk` was added to `peerDependencies` in this commit: dc1ac85375e17b281834f9131f60ee289945f00c)\r\n\r\nThanks."},"comment":{"url":"https://api.github.com/repos/joyent/node-http-signature/issues/comments/157852310","html_url":"https://github.com/joyent/node-http-signature/issues/51#issuecomment-157852310","issue_url":"https://api.github.com/repos/joyent/node-http-signature/issues/51","id":157852310,"user":{"login":"arekinath","id":496427,"avatar_url":"https://avatars.githubusercontent.com/u/496427?v=3","gravatar_id":"","url":"https://api.github.com/users/arekinath","html_url":"https://github.com/arekinath","followers_url":"https://api.github.com/users/arekinath/followers","following_url":"https://api.github.com/users/arekinath/following{/other_user}","gists_url":"https://api.github.com/users/arekinath/gists{/gist_id}","starred_url":"https://api.github.com/users/arekinath/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/arekinath/subscriptions","organizations_url":"https://api.github.com/users/arekinath/orgs","repos_url":"https://api.github.com/users/arekinath/repos","events_url":"https://api.github.com/users/arekinath/events{/privacy}","received_events_url":"https://api.github.com/users/arekinath/received_events","type":"User","site_admin":false},"created_at":"2015-11-18T20:23:01Z","updated_at":"2015-11-18T20:23:01Z","body":"This is all rather unfortunate. It seems that `peerDependencies` with `npm shrinkwrap` doesn't do at all what it does with `npm install` (which is also not what it's documented as supposed to do, either).\r\n\r\nThe reason why there is both a `peerDependencies` and `dependencies` entry for `sshpk` is that some of the public functions for `http-signature` in the latest version can accept `sshpk.Key` objects as an argument. To make sure that everything works properly, this means that anything that is using both `http-signature` and `sshpk` like this should make sure to use the same version of `sshpk` that `http-signature` does (or else the mixed versions may not play nicely) -- so the peerDependency enforces this, making sure there can only be one copy of the `sshpk` library in your `node_modules`.\r\n\r\nSince it doesn't look like `npm shrinkwrap` is going to be fixed any time soon wrt this (the bug has been open for a very long time), I guess I'll have to make `sshpk` detect any potential misbehaviour resulting from mixed versions at runtime (by tagging all of its own objects with what version they were created by, or something similar). Then the peerDependency can be dropped."}}