Two binary modules installing concurrently can corrupt node headers

[janv]

Since switching to yarn, we started observing random yarn install failures in one of our binary dependencies (fibers, the other being fsevents).

I was able to pinpoint the cause:

• Yarn is executing the install scripts of both deps in parallel
• The system doesn't have node headers
• Both install scripts invoke node-gyp
• Two instances of node-gyp running in parallel are both downloading node header files
• In around 10% of our builds, this resulted in a situation where I think one process was extracting files from a tarball that the other process was writing to. Not sure what exactly went on, but as a result the extracted header files were truncated and not parseable.

See yarnpkg/yarn#1874

Could this be solved by downloading and extracting into a tempdir and then moving that into its proper place afterwards?

[bnoordhuis]

Could? Yes. Should? I don't think so, downloading the same tarball twice is wasteful.

Since this happens with yarn and not npm, and because other download scripts are presumably also affected, I'm inclined to kick it back to yarn.