On Discord somebody mentioned that they won't use wasm-pack because it is insecure, because it is downloading a foreign URL without using a checksum to verify the integrity.

I agree with them, I think for security it's important to verify checksums on all downloaded binaries.

So first this will have to be added to binary-install, and then wasm-pack can be changed to use the checksums.

On Linux (Ubuntu WSL) this package works perfectly, but on Windows I get an error when I try to run the binary.

The console output:

> npm i -g wasm-pack
C:\Program Files\nodejs\wasm-pack -> C:\Program Files\nodejs\node_modules\wasm-pack\run.js

> [email protected] postinstall C:\Program Files\nodejs\node_modules\wasm-pack
> node -e 'require("./binary.js").install()'

+ [email protected]
added 35 packages from 22 contributors in 4.136s


> wasm-pack --help
fs.js:127
    throw err;
    ^

Error: ENOENT: no such file or directory, mkdir 'C:\Users\Wouter\AppData\Roaming\wasm-pack-nodejs\Config'
    at mkdirSync (fs.js:806:3)
    at Binary._getInstallDirectory (C:\Users\Wouter\AppData\Roaming\nvm\v12.9.1\node_modules\wasm-pack\node_modules\binary-install\src\binary.js:48:7)
    at Binary._getBinaryDirectory (C:\Users\Wouter\AppData\Roaming\nvm\v12.9.1\node_modules\wasm-pack\node_modules\binary-install\src\binary.js:54:35)
    at Binary._getBinaryPath (C:\Users\Wouter\AppData\Roaming\nvm\v12.9.1\node_modules\wasm-pack\node_modules\binary-install\src\binary.js:66:36)
    at Binary.run (C:\Users\Wouter\AppData\Roaming\nvm\v12.9.1\node_modules\wasm-pack\node_modules\binary-install\src\binary.js:122:29)
    at run (C:\Users\Wouter\AppData\Roaming\nvm\v12.9.1\node_modules\wasm-pack\binary.js:33:10)
    at Object.<anonymous> (C:\Users\Wouter\AppData\Roaming\nvm\v12.9.1\node_modules\wasm-pack\run.js:4:1)
    at Module._compile (internal/modules/cjs/loader.js:936:30)
    at Object.Module._extensions..js (internal/modules/cjs/loader.js:947:10)
    at Module.load (internal/modules/cjs/loader.js:790:32) {
  errno: -4058,
  syscall: 'mkdir',
  code: 'ENOENT',
  path: 'C:\\Users\\Wouter\\AppData\\Roaming\\wasm-pack-nodejs\\Config'
}

On Linux it also logs these lines during install, but they don't appear on Windows:

Downloading release ...
wasm-pack has been installed!

I double checked and I'm using the exact same commands on both systems. On Linux, instead of the error it shows me the help info as expected.

The error occured when trying to implement binary-install for my own package, but then I verified that it also happens with the latest published version of wasm-pack on npm.

I have to force exit, and the binary is not linked.

And I modified the script

#!/usr/bin/env node

const why = require('why-is-node-running')
const { install } = require("./binary");

install().then(() => {
  setInterval(() => {
    console.log('-------');
    why()
  }, 1000)
})

And logs as

$ node ./install-wrangler.js
Downloading release https://workers.cloudflare.com/get-npm-wrangler-binary/1.7.0/x86_64-apple-darwin
wrangler has been installed!
-------
There are 10 handle(s) keeping the process running

# TTYWRAP
/Users/magicdawn/.npm-global/lib/node_modules/@cloudflare/wrangler/node_modules/debug/src/node.js:76        - : tty.isatty(process.stderr.fd);
/Users/magicdawn/.npm-global/lib/node_modules/@cloudflare/wrangler/node_modules/debug/src/debug.js:120      - debug.useColors = exports.useColors();
/Users/magicdawn/.npm-global/lib/node_modules/@cloudflare/wrangler/node_modules/follow-redirects/index.js:6 - var debug = require("debug")("follow-redirects");

# SIGNALWRAP
/Users/magicdawn/.npm-global/lib/node_modules/@cloudflare/wrangler/node_modules/debug/src/node.js:76        - : tty.isatty(process.stderr.fd);
/Users/magicdawn/.npm-global/lib/node_modules/@cloudflare/wrangler/node_modules/debug/src/debug.js:120      - debug.useColors = exports.useColors();
/Users/magicdawn/.npm-global/lib/node_modules/@cloudflare/wrangler/node_modules/follow-redirects/index.js:6 - var debug = require("debug")("follow-redirects");

# TTYWRAP
/Users/magicdawn/.npm-global/lib/node_modules/@cloudflare/wrangler/node_modules/binary-install/src/binary.js:88 - console.log("Downloading release", this.url);
/Users/magicdawn/.npm-global/lib/node_modules/@cloudflare/wrangler/binary.js:37                                 - return binary.install();

# TCPWRAP
(unknown stack trace)

# TLSWRAP
(unknown stack trace)

# DNSCHANNEL
(unknown stack trace)

# HTTPCLIENTREQUEST
(unknown stack trace)

# Timeout
/Users/magicdawn/.npm-global/lib/node_modules/@cloudflare/wrangler/install-wrangler.js:7 - setInterval(() => {

# ZLIB
/Users/magicdawn/.npm-global/lib/node_modules/@cloudflare/wrangler/node_modules/minizlib/index.js:60  - this[_handle] = new realZlib[mode](opts)
/Users/magicdawn/.npm-global/lib/node_modules/@cloudflare/wrangler/node_modules/minizlib/index.js:193 - super(opts, mode)
/Users/magicdawn/.npm-global/lib/node_modules/@cloudflare/wrangler/node_modules/minizlib/index.js:292 - super(opts, 'Unzip')
/Users/magicdawn/.npm-global/lib/node_modules/@cloudflare/wrangler/node_modules/tar/lib/parse.js:347  - this[UNZIP] = new zlib.Unzip()

# TickObject
(unknown stack trace)

Hi, I would like to add a download progress bar while installation.

It's because current version will display Your package has been installed! even if the package is still downloading.
It will look like the installation is success but the npm install not finished.

For example:

blueworrybear@LAPTOP-0K8IJ0NA:~/projects/covergates-node$ npm install .

> [email protected] postinstall /home/blueworrybear/projects/covergates-node
> node ./install.js

Downloading release https://github.com/covergates/covergates/releases/download/v0.1.6/covergates-v0.1.6-linux-amd64.tar.gz
covergates has been installed!
^C
blueworrybear@LAPTOP-0K8IJ0NA:~/projects/covergates-node$ 

I have make a code change, which could be referred here: add download progress bar
With the update, the stdout will look like:

blueworrybear@LAPTOP-0K8IJ0NA:~/projects/covergates-node$ npm install .

> [email protected] postinstall /home/blueworrybear/projects/covergates-node
> node ./install.js

Downloading release from https://github.com/covergates/covergates/releases/download/v0.1.6/covergates-v0.1.6-linux-amd64.tar.gz
covergates in now installing
  downloading [====================] 723152/bps 100% 0.0s


covergates has been installed!
npm WARN [email protected] requires a peer of prettier@>=1.13.0 but none is installed. You must install peer dependencies yourself.

audited 138 packages in 45.738s

10 packages are looking for funding
  run `npm fund` for details

found 0 vulnerabilities

I love this project, it's very useful! So please consider this idea. I will make a PR if you agree.

Suddenly binary-install (https://www.npmjs.com/package/binary-install) installs package from https://github.com/EverlastingBugstopper/binary-install instead of this repository, so while I have a fixed version of binary-install package, it still changed under my hands making it incompatible (new Binary(url, { name }) vs new Binary(name, url)). No mention of this whatsoever in neither repositories.

Is one of these intended to be the canonical version? I see the @EverlastingBugstopper is the version available on NPM (https://www.npmjs.com/package/binary-install).

If EverlastingBugstopper/binary-install is the main repo these days, where is the best place to file issues?

Ideally, the run command should accept args in place of process.argv.

function run() {
...
if (arguments.length > 0) var args = arguments;
else var [, , ...args] = process.argv;

Currently, binary-install assumes that uninstalling should remove the entire directory from the user's machine, however some libraries may have application-specific code in that directory. If that is the case, they may want to give users the choice of whether or not they want to remove application-specific code, or just the binary.

binary-install should remove the entire directory by default, but should allow library consumers to toggle the feature where the user is prompted to either remove the entire directory or just the binary.

current code in uninstall that should remain the default

if (existsSync(this._getInstallDirectory())) {
  rimraf.sync(this.installDirectory);
  console.log(
    `${this.name ? this.name : "Your package"} has been uninstalled`
  );
}

if the user passes option.uninstallPrompt = true

"Would you like to remove all of your data associated with ${this.name}`? (y/n)

if y -> use existing default code

if n -> fs.unlink(this._getBinaryPath())