preinstall and postinstall are not run

[edoloughlin]

Do you want to request a feature or report a bug?
Bug
What is the current behavior?
preinstall and postinstall scripts are not run

If the current behavior is a bug, please provide the steps to reproduce.
run yarn

What is the expected behavior?
preinstall and postinstall scripts are executed

Please mention your node.js, yarn and operating system version.
yarn 0.15.1
node 4.5.0
Windows 7 (running via Cygwin and/or CMD)

[Jessidhia]

This seems to be intentional.

However, some alternative will need to be found... especially for the many packages that depend on node-gyp running on install.

[dominictarr]

There are a number of modules that use post-install script to download a prebuilt version of a package. (for example: electron-prebuilt, leveldown, sodium-prebuilt)
this makes yarn be slower than npm, also, on platforms where getting built tools setup is a pain (i.e. windows) it means you are able to use prebuilt modules without actually running a compiler.

This makes postinstall very much worth supporting.

[max-degterev]

we use postinstall in our build to create certain "package" symlinks, would also need some sort of postinstall trigger

[michaelperrin]

This issue is a duplicate of #721

[didierfranc]

So what is --ignore-script used for ?

yarn -h

Options:

    -h, --help                  output usage information
    -V, --version               output the version number
    --offline                   
    --prefer-offline            
    --strict-semver             
    --json                      
    --global-folder [path]      
    --modules-folder [path]     rather than installing modules into the node_modules folder relative to the cwd, output them here
    --packages-root [path]      rather than storing modules into a global packages root, store them here
    --mutex [type][:specifier]  use a mutex to ensure only one yarn instance is executing
    --har                       save HAR output of network traffic
    --ignore-engines            ignore engines check
    --ignore-scripts            
    --ignore-optional           
    --force                     
    --flat                      only allow one version of a package
    --prod, --production        
    --no-lockfile               don't read or generate a lockfile
    --pure-lockfile             don't generate a lockfile

[AndreiRailean]

postinstall is also not run in create-react-app, which breaks upgrades facebook/create-react-app#896

[FLGMwt]

Addressed in #800

[sebmck]

Fixed via #800.

[tomek-he-him]

Hey guys, good to know we now have full compatibility with the npm package lifecycle.

But preinstall and postinstall have always been bugging me as a massive security flaw. Supposing an attacker published a patch release to something like https://www.npmjs.com/package/once – he can now execute any code on all machines which use once somewhere in the dependency tree. Thousands or tens of thousands of developer laptops and production servers.

Do you see that as a concern worth addressing?