fix: always ignore ownership from tar headers (#261)

npm · Feb 21, 2023 · 8f4e39c · 8f4e39c
1 parent a08a9a3
commit 8f4e39c
Showing 1 changed file with 3 additions and 3 deletions.
diff --git a/lib/fetcher.js b/lib/fetcher.js
@@ -425,7 +425,7 @@ class FetcherBase {
     return ((mode | m) & ~this.umask) | exe | 0o600
   }
 
-  [_tarxOptions] ({ cwd, uid, gid }) {
+  [_tarxOptions] ({ cwd }) {
     const sawIgnores = new Set()
     return {
       cwd,
@@ -460,9 +460,9 @@ class FetcherBase {
         log.warn('tar', code, msg)
         log.silly('tar', code, msg, data)
       },
-      uid,
-      gid,
       umask: this.umask,
+      // always ignore ownership info from tarball metadata
+      preserveOwner: false,
     }
   }
 }