doc: add note re term-size commit on top of npm

Until npm updates update-notifier to a newer version, the dependency tree will contain a version of term-size that has an unsigned macOS binary. This will fail .pkg notarization and will result in failed release builds. We built and signed a term-size and contributed it back to the project for this purpose, but the dependency chain is long enough that it's not likely to be included in a new npm very quickly. Until it is, we need to cherry-pick commit d2f08a1 ontop of any npm updates to master and any other release branch that includes notarization. PR-URL: #32403 Reviewed-By: Sam Roberts <[email protected]> Reviewed-By: Michael Dawson <[email protected]>
nodejs · Mar 24, 2020 · 0e291aa · 0e291aa
1 parent a183b84
commit 0e291aa
Showing 1 changed file with 18 additions and 1 deletion.
diff --git a/doc/guides/maintaining-npm.md b/doc/guides/maintaining-npm.md
@@ -74,7 +74,24 @@ Note: please ensure you are only making the updates that are changed by npm.
 $ git rebase --whitespace=fix master
 ```
 
-## Step 7: Test the build
+## Step 7: Apply signed term-size commit
+
+The `term-size` package in npm's dependency tree contains an unsigned macOS
+binary in versions < 2.2.0. Until npm updates to a newer version of
+`update-notifier`, Node.js macOS package files can't be notarized and will fail
+to install on macOS Catalina and above.
+
+When `npm ls` shows a `term-size` package version < 2.2.0, cherry-pick
+commit `d2f08a1bdb` on top of the upgraded npm.
+
+```console
+$ git cherry-pick d2f08a1bdb
+```
+
+When `npm ls` shows a `term-size` package version >= 2.2.0, edit this file to
+remove this step.
+
+## Step 8: Test the build
 
 ```console
 $ make test-npm