Follow-up from #1095 (review thread #1095 (comment)).
In scripts/install.sh.tftpl, the tarball branch runs rm -rf "$NPM_WORKDIR" (the npm/ layout) before it fetches the registry metadata or downloads the replacement archive. #1095 introduced this so only one layout exists at a time and the installed version is always read from the active one. The order is wrong for the failure case: if a cached package-manager install has to be replaced through the tarball path (for example the workspace image lost its package manager) and the registry is unavailable, the script exits after deleting the working install and leaves $MUX_BINARY dangling.
Proposed change: download and extract the tarball into a temporary directory first, verify the binary, then switch the layout (move .mux-package into place, repoint the mux symlink) and remove npm/ last. The package-manager branch has the mirror-image ordering (rm -rf .mux-package before npm install) and should get the same treatment, although there the tarball layout is far less likely to be the one that is lost.
Xum acted on behalf of @ibetitsmike when filing this issue.
Follow-up from #1095 (review thread #1095 (comment)).
In
scripts/install.sh.tftpl, the tarball branch runsrm -rf "$NPM_WORKDIR"(thenpm/layout) before it fetches the registry metadata or downloads the replacement archive. #1095 introduced this so only one layout exists at a time and the installed version is always read from the active one. The order is wrong for the failure case: if a cached package-manager install has to be replaced through the tarball path (for example the workspace image lost its package manager) and the registry is unavailable, the script exits after deleting the working install and leaves$MUX_BINARYdangling.Proposed change: download and extract the tarball into a temporary directory first, verify the binary, then switch the layout (move
.mux-packageinto place, repoint themuxsymlink) and removenpm/last. The package-manager branch has the mirror-image ordering (rm -rf .mux-packagebeforenpm install) and should get the same treatment, although there the tarball layout is far less likely to be the one that is lost.