Permission Denied on Scoped packages

[lucky7id]

Attempting to install yarn add --dev @types/react-router generates the following error:

Ideally, this would simply install correctly. All the other typings have installed properly.

Specs
Node 6.3.0
Npm 3.10.3
Mac OS Sierra
Iterm 2
Zsh

[ddrozdov]

The issue probably is that the owner of the files in react-router-2.0.37.tgz is root (uid=0).
While for other @types packages the owner is uid=1000 that is usually the current user running yarn.

[despairblue]

@ddrozdov I think there is a different cause. The tgz is not even downloaded.

This also happens with a specific version of easy-table:

yarn add easy-table@0.0.1
yarn add v0.15.1
warning No license field
[1/4] Resolving packages...
[2/4] Fetching packages...
error https://registry.npmjs.org/easy-table/-/easy-table-0.0.1.tgz: EACCES: permission denied, open '/home/despairblue/.yarn-cache/npm-easy-table-0.0.1/lib/table.js'
    at Error (native)
info Visit http://yarnpkg.com/en/docs/cli/add for documentation about this command.

[despairblue]

probably same as #961

[ddrozdov]

@despairblue Why do you think it is not downloaded?
My guess was that it tries to extract the tgz and fails to create file with root permissions.

[despairblue]

@ddrozdov ah, I thought you meant that it was downloaded and extracted as root and cannot be accessed as a user.

[ddrozdov]

This was fixed by DefinitelyTyped/DefinitelyTyped#11932.
Latest versions of react-router and history don't have such an issue.

[despairblue]

@ddrozdov When I said that it does not download meant that yarn does not put the package in the cache. And that happens because there are packages where the executable bit is not set on directories, yarn does not normalize them (like npm does) and thus cannot access that directory. Then it bails.

This can be fixed upstream for new version, sadly this does not work for old packages since it's not allowed to publish over an existing version on the npm registry. Also upgrading is not always an options since this can also happen with transient dependencies, this rabbit hole can go quite deep.

I think resolving #961 is the only way to go here, if compatibility is the goal.

[arcanis]

This issue seems fixed, I'm going to close it. If you feel like this is a mistake, please feel free to reopen with repro steps. Thanks!