Undici tests depend on install hooks

[anonrig]

Adding the following lines to your .npmrc files will result in 5 test failures.

ignore-scripts=true

Example failing test:

test/unix.js 2> Error: ENOENT: no such file or directory, open '/Users/yagiz/Developer/undici/node_modules/https-pem/key.pem'
test/unix.js 2>     at Object.openSync (node:fs:601:3)
test/unix.js 2>     at Object.readFileSync (node:fs:469:35)
test/unix.js 2>     at Object.<anonymous> (/Users/yagiz/Developer/undici/node_modules/https-pem/index.js:6:18)
test/unix.js 2>     at Module._compile (node:internal/modules/cjs/loader:1241:14)
test/unix.js 2>     at Module._compile (/Users/yagiz/Developer/undici/node_modules/tap/node_modules/source-map-support/source-map-support.js:568:25)
test/unix.js 2>     at Object.Module._extensions..js (node:internal/modules/cjs/loader:1295:10)
test/unix.js 2>     at Module.load (node:internal/modules/cjs/loader:1091:32)
test/unix.js 2>     at Function.Module._load (node:internal/modules/cjs/loader:938:12)
test/unix.js 2>     at Module.require (node:internal/modules/cjs/loader:1115:19)
test/unix.js 2>     at require (node:internal/modules/helpers:130:18)

PS: For security reasons, I think undici shouldn't rely on preinstall hooks.

cc @KhafraDev @ronag

[mcollina]

PRs are welcomed!

[MaximeMRF]

Hello @mcollina @anonrig,

The 5 tests failures com from the https-pem package, there is a postinstall script in this package to generate the .pem files used for the tests.

Can you give me a track that I can dig to fix this issue because I don't really know what to do to avoid the using of postinstall for this specific use case ?

[Ethan-Arrowood]

Probably need to replace https-pem entirely. We should generate our own .pem files for testing purposes. It should be invokable using npm such as npm run gen-pem. We could try and make it a pretest script and see if npm will run it before running tests. It shouldn't generate the files every test run, just if they don't already exist.

[KhafraDev]

I believe https-pem was added so that we didn't need to manage the key/certificate ourselves. Tests fail once it expires.

[mcollina]

Could we run the generation script as the first command of npm test instead?

[metcoder95]

What about pretest and cache them?
Or the .pem files are being used somewhere else beyond testing?

[mcollina]

I think this
is only a problem for folks developing undici. I don't see howw replacing a npm hook with another would change anything.

(I'm not even sure if this is a problem).

[panva]

pretest is also ignored if ignore-scripts is set, having node ./node_modules/https-pem/install.js as the first command of npm test helps with minimal other changes.

You can also omit https-pem entirely, use its dependency selfsigned and generate the key and cert for every test that needs it entirely in process.

I think the former is easier to maintain and less intrusive.