[BUG] Dependencies scripts don't run when using v1 shrinkwrap

[koterpillar]

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

When:

• Installing a package (A)
• Which uses shrinkwrap version 1 (produced by npm 6)
• And has a dependency (B)
• Which is using node-gyp and a custom install script

B's custom install script does not run, instead it is replaced with node-gyp rebuild.

Example:

• @freekii/layerone-keytar@1.0.10 has been built and uploaded using npm 6
• It has npm-shrinkwrap.json with "lockfileVersion": 1
• It has keytar as a dependency
• keytar has prebuild-install || npm run build

When installing @freekii/layerone-keytar@1.0.10, keytar's install script will not run, falling back to node-gyp rebuild. If the machine has no Python and required system libraries, that will fail whereas the prebuild-install would have succeeded.

Expected Behavior

Dependencies' install scripts should run as specified in their package.json.

(Using example above) Installing @freekii/layerone-keytar@1.0.10 runs keytar's prebuild-install.

Steps To Reproduce

1. Create an empty npm package with a single dependency keytar (or use existing @freekii/layerone-keytar@1.0.10 and skip to sten 4).
2. Using npm 6, run npm shrinkwrap.
3. Publish the package to npm with the generated shrinkwrap.
4. On a machine without Python or C build tools (e.g. node:16 Docker container), install the above package from npm.
5. Observe the error from gyp:

npm ERR! code 1
npm ERR! path /usr/local/lib/node_modules/@freekii/layerone-keytar/node_modules/keytar
npm ERR! command failed
npm ERR! command sh -c -- node-gyp rebuild
(...)

Environment

• npm: 8.19.2
• Node.js: 16.17.0
• OS Name: Linux
• System Model Name: Docker container, via Macbook Pro
• npm config:

; node bin location = /usr/local/bin/node
; node version = v16.17.0
; npm local prefix = /
; npm version = 8.19.2
; cwd = /
; HOME = /root
; Run `npm config ls -l` to show all defaults.

[koterpillar]

Please note this is not a bug in npm 6. It was only used to produce the example package, but I expect npm 8 to be able to install older packages from the registry regardless.

[koterpillar]

I believe the meta.loadedFromDisk check is causing the bug here:

cli/workspaces/arborist/lib/arborist/rebuild.js

Line 257 in e5761b9

this[_oldMeta] = meta && meta.loadedFromDisk &&

[owlstronaut]

#9262