Unable to build Nomad with Nodejs v16 LTS

[dermotbradley]

Nomad version

1.1.6, 1.1.9 and 1.2.3

Operating system and Environment details

Alpine Linux v3.15 and Edge

Issue

Unable to build Nomad using Nodejs v16 - this version of Nodejs became LTS on 26th October as per https://nodejs.org/en/about/releases/

Appears to be a known Yuidoc issue: yui/yuidoc#453

Related Alpine issues:

https://gitlab.alpinelinux.org/alpine/aports/-/merge_requests/28610
https://gitlab.alpinelinux.org/alpine/aports/-/merge_requests/28611

Reproduction steps

Expected Result

Actual Result

error: An uncaught YUIDoc error has occurred, stack trace given below
error: -------------------------------------------------------------------------
-
error: TypeError [ERR_INVALID_ARG_TYPE]: The "options" argument must be of type object. Received an instance of Array
    at ChildProcess.target.send (node:internal/child_process:713:7)
    at Array.forEach (<anonymous>)
    at dispatchQueuedRequests (/home/builder/package/src/nomad-1.1.6/ui/node_modules/ember-cli-test-loader/node_modules/workerpool/lib/WorkerHandler.js:174:21)
    at ChildProcess.<anonymous> (/home/builder/package/src/nomad-1.1.6/ui/node_modules/ember-cli-test-loader/node_modules/workerpool/lib/WorkerHandler.js:129:7)
    at ChildProcess.emit (node:events:390:28)
    at ChildProcess.emit (node:domain:475:12)
    at emit (node:internal/child_process:917:12)
    at processTicksAndRejections (node:internal/process/task_queues:84:21)
error: --------------------------------------------------------------------------
error: Node.js version: v16.13.1
error: YUI version: 3.18.1
error: YUIDoc version: 0.10.2
error: Please file all tickets here: http://github.com/yui/yuidoc/issues
error: --------------------------------------------------------------------------

Job file (if appropriate)

Nomad Server logs (if appropriate)

Nomad Client logs (if appropriate)

[DerekStrickland]

Thanks for filing this issue! We'll take a look at it as soon as possible.

[ChaiWithJai]

Hey, this is likely because we're using ember-cli: 3.20. We need to upgrade 2 LTS's to ember-cli: 3.28. This requires dependency upgrades that would need to be tackled in a major release 1.3.

For now, we can only support Node v12. This issue has been on our radar and a candidate to tackle in 1.3.

[dermotbradley]

@ChaiWithJai The Alpine current release (3.15.x) has Nomad 1.1.1 and NodeJS 16.13.1 packaged so we're stuck as Nomad 1.1.9 cannot be packaged for the recent security fixes due to this issue...

[dermotbradley]

@ChaiWithJai

Any indication of timescales for a Nomad 1.3 release containing support for the current NodeJS LTS?

Alpine is still stuck with Nomad 1.1.1 in its current "stable" release (v3.15.0) and this Nomad version obviously does not have the security fixes from 1.1.2-1.1.9.

Should we remove Nomad completely from the current stable Alpine release? I see no other way to address the security implications of shipping a version with known CVEs.

We cannot switch NodeJs back to the previous LTS release as other packages in Alpine v3.15.0 may be relying on NodeJS 16.x.

[tgross]

Hi @dermotbradley!

Any indication of timescales for a Nomad 1.3 release containing support for the current NodeJS LTS?

Generally speaking we don't give firm timelines for releases, because lots can happen between now and then. But our rough plan is on the scale of "a couple months" rather than "a couple days".

Alpine is still stuck with Nomad 1.1.1 in its current "stable" release (v3.15.0) and this Nomad version obviously does not have the security fixes from 1.1.2-1.1.9.

While I'm definitely sympathetic to this... it doesn't seem like security patches are really relevant to this issue, are they?

Here's where you may need to fill in for us a little bit in terms of Alpine processes around stale builds of packages, but my understanding is that the distro won't ship packages that it can't currently build. (Which is good!) So the problem isn't that you can't package newer versions of Nomad, but that the NodeJS package in Alpine stable has been bumped out from under us. So no versions of Nomad can be packaged until we bump the dependency. Even if there were no security patches or you were to backport them, you can't continue to package Nomad with our required version of NodeJS.

Should we remove Nomad completely from the current stable Alpine release? I see no other way to address the security implications of shipping a version with known CVEs.

I see a few options here:

• As far as I can tell YUIDoc isn't a runtime dependency (@ChaiWithJai may need to check me on this). You could conceivably patch it out.
• NodeJS isn't a runtime dependency at all! Alpine's build infrastructure could in theory provide arbitrary NodeJS versions with isolated build environments, that don't get packaged with the final package.

But I totally understand that either of those options might not work with Alpine's packaging policies! In which case, yes, you might need to remove Nomad from Alpine stable until we've released 1.3.0. That's unfortunate but we'll definitely make sure we get a newer NodeJS LTS by then (Node 12 is towards the end of maintenance anyways).

---

As an aside: Nomad has some CGO dependencies and we frankly don't test with musl at all. I'd love to hear more about how Alpine validates the package after the build, as that might help influence us to put the work in to do the same validation and that'll get Nomad into the hands of more Alpine users without them doing terrible things like installing glibc in Alpine. 😀

[loqs]

I encountered a similar failure with vault. The change in nodejs causing the issue is 1. The fix for workerpool is 2. nomad 1.2.6 uses workerpool 2.3.3 3 the same as vault 1.9.4. I was able to get vault to build with nodejs 16 by vendoring a patched workerpool 2.3.3, I did not have to patch workerpool 3.1.2. @dermotbradley perhaps that can provide you with a solution until 1.3.0 is released.