Security News
Maven Central Adds Sigstore Signature Validation
Maven Central now validates Sigstore signatures, making it easier for developers to verify the provenance of Java packages.
Automatically generates an RPM Spec file for your Node.js project
npm install --global speculate
package.json
Let's start with a simple Node.js project:
my-cool-api
├── package.json
└── server.js
0 directories, 2 files
First run npm install to install your dependencies:
npm install
This creates the node_modules
directory:
my-cool-api
├── node_modules
├── package.json
└── server.js
1 directory, 2 files
Run the speculate
command from inside the project directory:
speculate
You've now got an RPM Spec file and a systemd service definition for your project. You'll also notice that your application has been packaged into a tar.gz
archive, ready to be built with an RPM building tool like rpmbuild
or mock
:
my-cool-api
├── SOURCES
│ └── my-cool-api.tar.gz
├── SPECS
│ └── my-cool-api.spec
├── node_modules
├── my-cool-api.service
├── package.json
└── server.js
3 directories, 5 files
Speculate is designed to be used at build time, just before you package your application into an RPM. Because of this, we recommend adding the generated files to your .gitignore
file:
*.service
SOURCES
SPECS
Speculate assumes that you've already installed your npm dependencies when it is run. This means that you don't need to worry about running npm install
inside a clean RPM-building environment like mock.
The generated spec file instructs your RPM building tool to run npm rebuild
as part of the build process. This ensures that any native modules are rebuilt for your target environment, even if they were originally installed on a different platform.
A typical speculate build looks like this:
npm install
npm test
speculate
# build the RPM (using rpmbuild, mock etc.)
To avoid the need to install speculate globally, we recommend installing it locally and creating an npm script in your package.json
file:
npm install --save-dev speculate
{
"scripts": {
"spec": "speculate"
}
}
You can then run npm run spec
to generate your spec file in an environment where speculate isn't installed globally (like your CI server.)
To minimise the final RPM size, your development dependencies (dependencies added with the --save-dev flag) are automatically pruned so that they're not shipped with your production code.
If for some reason you need to package your dev dependencies with your production code you can explicity tell speculate not to prune by adding the following to your package.json:
{
"spec": {
"prune": false
}
}
npm start
scriptThe systemd service file that Speculate generates uses the npm start
script to start your application. Make sure that you've defined this script in your package.json
file.
{
"scripts": {
"start": "node server.js"
}
}
The spec file that speculate generates isn't tied to a particular Node version. It simply requires the nodejs
package. It's up to you to make the package available when you install the RPM using yum
.
We strongly recommend that you use the Nodesource binary distributions to install a modern version of Node.js for both your RPM building environment and your target server. Follow the setup instructions for Enterprise Linux and then run yum install nodejs
.
Speculate creates the following directories for your application:
Directory | Purpose |
---|---|
/usr/lib/:projectName | This is where your application is stored |
/var/log/:projectName | This is created for any log files that your application needs to write to |
Speculate is configured using the spec
property inside your existing package.json
file.
To add a dependency to the generated spec file, list the package dependencies in the requires
array:
{
"spec": {
"requires": [
"vim",
"screen"
]
}
}
If you have scripts that need to be executable when they're installed on your target server, add them to the executable
array. You can list both files and entire directories:
{
"spec": {
"executable": [
"./other-scripts/my-script.js",
"./scripts"
]
}
}
If you need to perform any actions after installing your package (such as moving files on the target server) you can specify these inline using the post
property:
{
"spec": {
"post": [
"mv /usr/lib/my-cool-api/rc.local /etc/rc.local"
]
}
}
By default speculate will set the RPM release number to 1, if you want to override this you can do so by using the --release
flag:
speculate --release=7
By default speculate will set the name from package.json
, if you want to override this you can do so by using the --name
flag:
speculate --name=my-cool-api
This is useful if you are using private NPM packages which start with an @
.
FAQs
Automatically generates an RPM Spec file for your Node.js project
The npm package speculate receives a total of 0 weekly downloads. As such, speculate popularity was classified as not popular.
We found that speculate demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 51 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Maven Central now validates Sigstore signatures, making it easier for developers to verify the provenance of Java packages.
Security News
CISOs are racing to adopt AI for cybersecurity, but hurdles in budgets and governance may leave some falling behind in the fight against cyber threats.
Research
Security News
Socket researchers uncovered a backdoored typosquat of BoltDB in the Go ecosystem, exploiting Go Module Proxy caching to persist undetected for years.