chore: fix lzma-native build issues on Windows (#1191)

* chore: fix `lzma-native` build issues on Windows

We've been recently hitting a weird `lzma-native` build error on Windows
(both locally and on Appveyor CI):

```
Building the projects in this solution one at a time. To enable parallel build, please add the "/m" switch.
  build
  The input line is too long.

C:\Program Files (x86)\MSBuild\Microsoft.Cpp\v4.0\V140\Microsoft.CppCommon.targets(171,5): error MSB6006: "cmd.exe" exited with code 1. [C:\projects\etcher\node_modules\lzma-native\build\liblzma.vcxproj]
```

After a lot of experimentation, we realised the issue was gone if we
removed `node-sass` from the development dependencies.

The issue is that `node-gyp` was recently upgraded to v3.6.0, which was
picked up by `node-sass`, which declares `node-gyp` as a dependency. For
some reason, if `node-sass` causes `node-gyp` to be updated, then
`lzma-native` fails with the above cryptic error.

I was able to trace down the error to the following `node-gyp` commit:

ae141e1906

As a solution, this commit starts to shrinkwrap development
dependencies, and locks `node-gyp` to v3.5.0 until the issue is fixed.

Fixes: https://github.com/addaleax/lzma-native/issues/30
See: https://github.com/nodejs/node-gyp/issues/1151
Signed-off-by: Juan Cruz Viotti <jviotti@openmailbox.org>

* chore: ensure some modules in npm-shrinkwrap stay at specific versions

* Address code review comments

Signed-off-by: Juan Cruz Viotti <jviotti@openmailbox.org>

Makefile

@@ -427,6 +427,7 @@ info:
 sanity-checks:
 	./scripts/ci/ensure-staged-sass.sh
 	./scripts/ci/ensure-npm-dependencies-compatibility.sh
+	./scripts/ci/ensure-npm-shrinkwrap-versions.sh
 
 clean:
 	rm -rf $(BUILD_DIRECTORY)

docs/CONTRIBUTING.md

@@ -48,17 +48,6 @@ Use the following steps to ensure everything goes flawlessly:
   operating system specific dependencies that could get included in the
   previous step are removed from `npm-shrinkwrap.json`.
 
-Some npm versions seem to contain an issue were all development dependencies
-will be included in `npm-shrinkwrap.json` when attempting to modify it (e.g: by
-`npm install`, `npm uninstall`, etc). A bulletproof way to ensure only the
-necessary dependencies get added is to run the following commands:
-
-```sh
-make electron-develop
-npm prune --production
-npm shrinkwrap
-```
-
 - Commit *both* `package.json` and `npm-shrinkwrap.json`.
 
 Testing

scripts/build/dependencies-npm.sh

@@ -95,6 +95,21 @@ if [ "$ARGV_PRODUCTION" == "true" ]; then
   INSTALL_OPTS="$INSTALL_OPTS --production"
 fi
 
+function run_install() {
+  npm install $INSTALL_OPTS
+
+  if [ "$ARGV_PRODUCTION" == "true" ]; then
+
+    # Turns out that if `npm-shrinkwrap.json` contains development
+    # dependencies then `npm install --production` will also install
+    # those, despite knowing, based on `package.json`, that they are
+    # really development dependencies. As a workaround, we manually
+    # delete the development dependencies using `npm prune`.
+    npm prune --production
+
+  fi
+}
+
 if [ -n "$ARGV_PREFIX" ]; then
   cp "$PWD/package.json" "$ARGV_PREFIX/package.json"
 
@@ -103,11 +118,11 @@ if [ -n "$ARGV_PREFIX" ]; then
   fi
 
   pushd "$ARGV_PREFIX"
-  npm install $INSTALL_OPTS
+  run_install
   popd
 
   rm -f "$ARGV_PREFIX/package.json"
   rm -f "$ARGV_PREFIX/npm-shrinkwrap.json"
 else
-  npm install $INSTALL_OPTS
+  run_install
 fi

scripts/ci/ensure-npm-shrinkwrap-versions.sh

@@ -0,0 +1,46 @@
+#!/bin/bash
+
+###
+# Copyright 2017 resin.io
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+###
+
+set -u
+set -e
+
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+"$HERE/../build/check-dependency.sh" jq
+
+SHRINKWRAP_JSON=npm-shrinkwrap.json
+
+# Two pair-wise arrays, because associative arrays only work in Bash 4
+MODULE_NAMES=("dependencies[\"node-gyp\"]")
+MODULE_VERSIONS=("3.5.0")
+
+if [[ ${#MODULE_NAMES[@]} -ne ${#MODULE_VERSIONS[@]} ]]; then
+    echo "Lengths of MODULE_NAMES and MODULE_VERSIONS arrays must match"
+    exit 1
+fi
+
+for i in ${!MODULE_NAMES[@]}; do
+    name=${MODULE_NAMES[$i]}
+    version=${MODULE_VERSIONS[$i]}
+    shrinkwrap_version=$(jq -r ".$name.version" "$SHRINKWRAP_JSON")
+    if [[ "$version" != "$shrinkwrap_version" ]]; then
+        echo "The following dependency must have the exact version in $SHRINKWRAP_JSON:"
+        echo "    $name $version"
+        exit 1
+    fi
+done

scripts/clean-shrinkwrap.js

@@ -18,21 +18,10 @@
 const _ = require('lodash');
 const path = require('path');
 const jsonfile = require('jsonfile');
-const childProcess = require('child_process');
 const packageJSON = require('../package.json');
 const shrinkwrapIgnore = _.union(packageJSON.shrinkwrapIgnore, _.keys(packageJSON.optionalDependencies));
-const EXIT_CODES = require('../lib/shared/exit-codes');
 const SHRINKWRAP_PATH = path.join(__dirname, '..', 'npm-shrinkwrap.json');
 
-try {
-  console.log(childProcess.execSync('npm shrinkwrap', {
-    cwd: path.dirname(SHRINKWRAP_PATH)
-  }));
-} catch (error) {
-  console.error(error.stderr.toString());
-  process.exit(EXIT_CODES.GENERAL_ERROR);
-}
-
 const shrinkwrapContents = jsonfile.readFileSync(SHRINKWRAP_PATH);
 shrinkwrapContents.dependencies = _.omit(shrinkwrapContents.dependencies, shrinkwrapIgnore);
 jsonfile.writeFileSync(SHRINKWRAP_PATH, shrinkwrapContents, {