Installations
npm install prebuild-install
Score
88.4
Supply Chain
98.1
Quality
81.7
Maintenance
100
Vulnerability
99.3
License
Developer
prebuild
Developer Guide
Module System
Unable to determine the module system for this package.
Min. Node Version
>=10
Typescript Support
No
Node Version
16.20.2
NPM Version
8.19.4
Statistics
103 Stars
226 Commits
75 Forks
9 Watching
2 Branches
42 Contributors
Updated on 11 Nov 2024
Bundle Size
73.92 kB
Minified
22.68 kB
Minified + Gzipped
Languages
JavaScript (100%)
Total Downloads
Cumulative downloads
Total Downloads
1,022,052,399
Last day
-5.8%
1,114,331
Compared to previous day
Last week
2%
6,482,404
Compared to previous week
Last month
7.4%
27,370,727
Compared to previous month
Last year
29.3%
306,433,358
Compared to previous year
Daily Downloads
Weekly Downloads
Monthly Downloads
Yearly Downloads
prebuild-install
A command line tool to easily install prebuilt binaries for multiple versions of Node.js & Electron on a specific platform. By default it downloads prebuilt binaries from a GitHub release.
Note
Instead of prebuild
paired with prebuild-install
, we recommend prebuildify
paired with node-gyp-build
.
With prebuildify
, all prebuilt binaries are shipped inside the package that is published to npm, which means there's no need for a separate download step like you find in prebuild
. The irony of this approach is that it is faster to download all prebuilt binaries for every platform when they are bundled than it is to download a single prebuilt binary as an install script.
Upsides:
- No extra download step, making it more reliable and faster to install.
- Supports changing runtime versions locally and using the same install between Node.js and Electron. Reinstalling or rebuilding is not necessary, as all prebuilt binaries are in the npm tarball and the correct one is simply picked on runtime.
- The
node-gyp-build
runtime dependency is dependency-free and will remain so out of principle, because introducing dependencies would negate the shorter install time. - Prebuilt binaries work even if npm install scripts are disabled.
- The npm package checksum covers prebuilt binaries too.
Downsides:
- The installed npm package is larger on disk. Using Node-API alleviates this because Node-API binaries are runtime-agnostic and forward-compatible.
- Publishing is mildly more complicated, because
npm publish
must be done after compiling and fetching prebuilt binaries (typically in CI).
Usage
Use prebuild
to create and upload prebuilt binaries. Then change your package.json install script to:
1{ 2 "scripts": { 3 "install": "prebuild-install || node-gyp rebuild" 4 } 5}
When a consumer then installs your package with npm thus triggering the above install script, prebuild-install
will download a suitable prebuilt binary, or exit with a non-zero exit code if there is none, which triggers node-gyp rebuild
in order to build from source.
Options (see below) can be passed to prebuild-install
like so:
1{ 2 "scripts": { 3 "install": "prebuild-install -r napi || node-gyp rebuild" 4 } 5}
Help
prebuild-install [options]
--download -d [url] (download prebuilds, no url means github)
--target -t version (version to install for)
--runtime -r runtime (Node runtime [node, napi or electron] to build or install for, default is node)
--path -p path (make a prebuild-install here)
--token -T gh-token (github token for private repos)
--arch arch (target CPU architecture, see Node OS module docs, default is current arch)
--platform platform (target platform, see Node OS module docs, default is current platform)
--tag-prefix <prefix> (github tag prefix, default is "v")
--build-from-source (skip prebuild download)
--verbose (log verbosely)
--libc (use provided libc rather than system default)
--debug (set Debug or Release configuration)
--version (print prebuild-install version and exit)
When prebuild-install
is run via an npm
script, options --build-from-source
, --debug
, --download
, --target
, --runtime
, --arch
--platform
and --libc
may be passed through via arguments given to the npm
command.
Alternatively you can set environment variables npm_config_build_from_source=true
, npm_config_platform
, npm_config_arch
, npm_config_target
npm_config_runtime
and npm_config_libc
.
Libc
On non-glibc Linux platforms, the Libc name is appended to platform name. For example, musl-based environments are called linuxmusl
. If --libc=glibc
is passed as option, glibc is discarded and platform is called as just linux
. This can be used for example to build cross-platform packages on Alpine Linux.
Private Repositories
prebuild-install
supports downloading prebuilds from private GitHub repositories using the -T <github-token>
:
$ prebuild-install -T <github-token>
If you don't want to use the token on cli you can put it in ~/.prebuild-installrc
:
token=<github-token>
Alternatively you can specify it in the prebuild-install_token
environment variable.
Note that using a GitHub token uses the API to resolve the correct release meaning that you are subject to the (GitHub Rate Limit).
Create GitHub Token
To create a token:
- Go to this page
- Click the
Generate new token
button - Give the token a name and click the
Generate token
button, see below
The default scopes should be fine.
Custom binaries
The end user can override binary download location through environment variables in their .npmrc file.
The variable needs to meet the mask % your package name %_binary_host
or % your package name %_binary_host_mirror
. For example:
leveldown_binary_host=http://overriden-host.com/overriden-path
Note that the package version subpath and file name will still be appended.
So if you are installing leveldown@1.2.3
the resulting url will be:
http://overriden-host.com/overriden-path/v1.2.3/leveldown-v1.2.3-node-v57-win32-x64.tar.gz
Local prebuilds
If you want to use prebuilds from your local filesystem, you can use the % your package name %_local_prebuilds
.npmrc variable to set a path to the folder containing prebuilds. For example:
leveldown_local_prebuilds=/path/to/prebuilds
This option will look directly in that folder for bundles created with prebuild
, for example:
/path/to/prebuilds/leveldown-v1.2.3-node-v57-win32-x64.tar.gz
Non-absolute paths resolve relative to the directory of the package invoking prebuild-install, e.g. for nested dependencies.
Cache
All prebuilt binaries are cached to minimize traffic. So first prebuild-install
picks binaries from the cache and if no binary could be found, it will be downloaded. Depending on the environment, the cache folder is determined in the following order:
${npm_config_cache}/_prebuilds
${APP_DATA}/npm-cache/_prebuilds
${HOME}/.npm/_prebuilds
Install
With npm do:
npm install prebuild-install
License
No vulnerabilities found.
Reason
no binaries found in the repo
Reason
no dangerous workflow patterns detected
Reason
0 existing vulnerabilities detected
Reason
license file detected
Details
- Info: project has a license file: LICENSE:0
- Info: FSF or OSI recognized license: MIT License: LICENSE:0
Reason
Found 12/30 approved changesets -- score normalized to 4
Reason
0 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 0
Reason
detected GitHub workflow tokens with excessive permissions
Details
- Warn: topLevel 'contents' permission set to 'write': .github/workflows/release.yml:6
- Info: topLevel 'contents' permission set to 'read': .github/workflows/test.yml:4
- Info: no jobLevel write permissions found
Reason
dependency not pinned by hash detected -- score normalized to 0
Details
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:13: update your workflow using https://app.stepsecurity.io/secureworkflow/prebuild/prebuild-install/release.yml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yml:15: update your workflow using https://app.stepsecurity.io/secureworkflow/prebuild/prebuild-install/release.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/prebuild/prebuild-install/test.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:22: update your workflow using https://app.stepsecurity.io/secureworkflow/prebuild/prebuild-install/test.yml/master?enable=pin
- Warn: npmCommand not pinned by hash: .github/workflows/test.yml:28
- Info: 0 out of 3 GitHub-owned GitHubAction dependencies pinned
- Info: 0 out of 1 third-party GitHubAction dependencies pinned
- Info: 0 out of 1 npmCommand dependencies pinned
Reason
no effort to earn an OpenSSF best practices badge detected
Reason
security policy file not detected
Details
- Warn: no security policy file detected
- Warn: no security file to analyze
- Warn: no security file to analyze
- Warn: no security file to analyze
Reason
project is not fuzzed
Details
- Warn: no fuzzer integrations found
Reason
SAST tool is not run on all commits -- score normalized to 0
Details
- Warn: 0 commits out of 13 are checked with a SAST tool
Score
4.2
/10
Last Scanned on 2024-11-18
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn MoreOther packages similar to prebuild-install
@mmomtchev/prebuild-install
prebuild-install modified for hadron
node-gyp-build
Build tool and bindings loader for node-gyp that supports prebuilds
node-gyp-build-optional-packages
Build tool and bindings loader for node-gyp that supports prebuilds
@expo/prebuild-config
Get the prebuild config