setup.sh yarn install fails - "Commit hash required"

[GFJHogue]

• JBrowse version: 1.16.6 & 1.16.10
• Operating system: Ubuntu 20.04.1 & in Docker
• Relevant part of setup.log

yarn install v1.22.4
warning package-lock.json found. Your project contains lock files generated by tools other than Yarn. It is advised not to mix package managers in order to avoid resolution inconsistencies caused by unsynchronized lock files. To clear this warning, remove package-lock.json.
[1/4] Resolving packages...
[2/4] Fetching packages...
error An unexpected error occurred: "Commit hash required".

Full setup.sh output at line 356 and onward https://travis-ci.com/github/LincolnSteinLab/gdc-viewer/builds/198342967

---

Noticed this when my Travis tests started failing.

Testing locally, I was able to reproduce this issue by running npm install yarn followed by node_modules/.bin/yarn install as per

jbrowse/setup.sh

Line 133 in b8324df

node_modules/.bin/yarn install

However installing yarn "globally" with npm i -g yarn and running yarn install (with same node/yarn versions) works fine for me, so that's my workaround for now.

Since I was able to reproduce with JBrowse 1.16.6 & 1.16.10, I'm guessing a hash changed for something in yarn.lock.

[cmdcolin]

There is an issue thread on the yarn repo where it says this can be due to

• old version/upgrade yarn/mystery thing
• replace git+https to git+ssh on packages that install direct from github. We install one package direct from github, jszlib, in our package.json

yarnpkg/yarn#2976

I can't reproduce this locally so hard to say. Maybe we leave this open until we can find a proper fix

[cmdcolin]

Also, we can't replace git+https to git+ssh because we get issue reports saying peoples firewalls block ssh

A real ideal would be replacing this old jszlib dependency but that will take a little work, probably replace with pako

[cmdcolin]

Also, it is unclear whether this is the jszlib thing or just mystery thing, that is just the only dependency that explicitly points to a github repo but there are other things that could be using hashes in the dependency tree

[cmdcolin]

I think both @hans-vg and @GFJHogue confirmed this fixed their local workflow (yay)

closing for now