fix: ensure read and write permission like npm (#245)

lib/download/npm.js

@@ -379,7 +379,20 @@ function checkShasumAndUngzip(ungzipDir, readstream, pkg, useTarFormat) {
   return function(callback) {
     const shasum = pkg.dist.shasum;
     const hash = crypto.createHash('sha1');
-    const extracter = tar.Extract({ path: ungzipDir, strip: 1 });
+    const extracter = tar.extract({
+      cwd: ungzipDir,
+      strip: 1,
+      onentry(entry) {
+        if (entry.type.toLowerCase() === 'file') {
+          /* eslint-disable no-bitwise */
+          entry.mode = (entry.mode || 0) | 0o644;
+        }
+        if (entry.type.toLowerCase() === 'directory') {
+          /* eslint-disable no-bitwise */
+          entry.mode = (entry.mode || 0) | 0o755;
+        }
+      },
+    });
 
     function handleCallback(err) {
       if (err) {

lib/utils.js

@@ -206,7 +206,20 @@ exports.getPackageStorePath = function(storeDir, pkg) {
 
 exports.unpack = function(readstream, target, pkg) {
   return new Promise((resolve, reject) => {
-    const extracter = tar.Extract({ path: target, strip: 1 });
+    const extracter = tar.extract({
+      cwd: target,
+      strip: 1,
+      onentry(entry) {
+        if (entry.type.toLowerCase() === 'file') {
+          /* eslint-disable no-bitwise */
+          entry.mode = (entry.mode || 0) | 0o644;
+        }
+        if (entry.type.toLowerCase() === 'directory') {
+          /* eslint-disable no-bitwise */
+          entry.mode = (entry.mode || 0) | 0o755;
+        }
+      },
+    });
     const gunzip = zlib.createGunzip();
     const name = pkg.name || pkg.displayName || 'unknown package';
 

package.json

@@ -48,7 +48,7 @@
     "rimraf": "^2.6.1",
     "runscript": "^1.2.1",
     "semver": "^5.3.0",
-    "tar": "^2.2.1",
+    "tar": "^4.0.1",
     "urllib": "^2.24.0",
     "utility": "^1.12.0",
     "uuid": "^3.0.1"

test/fmode.test.js

@@ -0,0 +1,35 @@
+'use strict';
+
+const assert = require('assert');
+const path = require('path');
+const fs = require('fs');
+const rimraf = require('rimraf');
+const coffee = require('coffee');
+const npminstall = path.join(__dirname, '../bin/install.js');
+
+if (process.platform !== 'win32') {
+  describe('test/fmode.test.js', () => {
+    const homedir = path.join(__dirname, 'fixtures', '.tmp');
+
+    function cleanup() {
+      rimraf.sync(homedir);
+    }
+
+    beforeEach(() => {
+      cleanup();
+      fs.mkdir(homedir);
+    });
+    afterEach(cleanup);
+
+    it('should fix file mode success', function* () {
+      yield coffee.fork(npminstall, [ 'array-unique@0.2.1' ], {
+        cwd: homedir,
+      })
+      .debug()
+      .end();
+      const stat = fs.statSync(path.join(homedir, 'node_modules/array-unique/index.js'));
+      // 700 -> 744
+      assert(stat.mode === 33252);
+    });
+  });
+}