npm: Upgrade to v1.2.10

13 files changed, 226 insertions, 58 deletions

diff --git a/deps/npm/lib/build.js b/deps/npm/lib/build.js
index 815739c460..d9deb32da1 100644
--- a/deps/npm/lib/build.js
+++ b/deps/npm/lib/build.js
@@ -69,6 +69,9 @@ function writeBuiltinConf (folder, cb) {
 }
 
 function linkStuff (pkg, folder, global, didRB, cb) {
+  // allow to opt out of linking binaries.
+  if (npm.config.get("bin-links") === false) return cb()
+
   // if it's global, and folder is in {prefix}/node_modules,
   // then bins are in {prefix}/bin
   // otherwise, then bins are in folder/../.bin
@@ -109,7 +112,7 @@ function rebuildBundles (pkg, folder, parent, gtop, cb) {
     chain(files.filter(function (file) {
       // rebuild if:
       // not a .folder, like .bin or .hooks
-      return file.charAt(0) !== "."
+      return !file.match(/^[\._-]/)
           // not some old 0.x style bundle
           && file.indexOf("@") === -1
           // either not a dep, or explicitly bundled
diff --git a/deps/npm/lib/cache.js b/deps/npm/lib/cache.js
index 7b83350d80..5e92ef526f 100644
--- a/deps/npm/lib/cache.js
+++ b/deps/npm/lib/cache.js
@@ -139,7 +139,7 @@ function read (name, ver, forceBypass, cb) {
   }
 
   readJson(jsonFile, function (er, data) {
-    if (er && er.code !== "ENOENT") return cb(er)
+    if (er && er.code !== "ENOENT" && er.code !== "ENOTDIR") return cb(er)
     if (er) return addNamed(name, ver, c)
     deprCheck(data)
     c(er, data)
@@ -389,6 +389,7 @@ function addRemoteGit (u, parsed, name, cb_) {
     // it needs the ssh://
     // If the path is like ssh://foo:some/path then it works, but
     // only if you remove the ssh://
+    var origUrl = u
     u = u.replace(/^git\+/, "")
          .replace(/#.*$/, "")
 
@@ -404,16 +405,16 @@ function addRemoteGit (u, parsed, name, cb_) {
 
     p = path.join(npm.config.get("cache"), "_git-remotes", v)
 
-    checkGitDir(p, u, co, cb)
+    checkGitDir(p, u, co, origUrl, cb)
   })
 }
 
-function checkGitDir (p, u, co, cb) {
+function checkGitDir (p, u, co, origUrl, cb) {
   fs.stat(p, function (er, s) {
-    if (er) return cloneGitRemote(p, u, co, cb)
+    if (er) return cloneGitRemote(p, u, co, origUrl, cb)
     if (!s.isDirectory()) return rm(p, function (er){
       if (er) return cb(er)
-      cloneGitRemote(p, u, co, cb)
+      cloneGitRemote(p, u, co, origUrl, cb)
     })
 
     var git = npm.config.get("git")
@@ -427,16 +428,16 @@ function checkGitDir (p, u, co, cb) {
                 + "wrong result ("+u+")", stdoutTrimmed )
         return rm(p, function (er){
           if (er) return cb(er)
-          cloneGitRemote(p, u, co, cb)
+          cloneGitRemote(p, u, co, origUrl, cb)
         })
       }
       log.verbose("git remote.origin.url", stdoutTrimmed)
-      archiveGitRemote(p, u, co, cb)
+      archiveGitRemote(p, u, co, origUrl, cb)
     })
   })
 }
 
-function cloneGitRemote (p, u, co, cb) {
+function cloneGitRemote (p, u, co, origUrl, cb) {
   mkdir(p, function (er) {
     if (er) return cb(er)
     exec( npm.config.get("git"), ["clone", "--mirror", u, p], gitEnv(), false
@@ -447,12 +448,12 @@ function cloneGitRemote (p, u, co, cb) {
         return cb(er)
       }
       log.verbose("git clone " + u, stdout)
-      archiveGitRemote(p, u, co, cb)
+      archiveGitRemote(p, u, co, origUrl, cb)
     })
   })
 }
 
-function archiveGitRemote (p, u, co, cb) {
+function archiveGitRemote (p, u, co, origUrl, cb) {
   var git = npm.config.get("git")
   var archive = ["fetch", "-a", "origin"]
   var resolve = ["rev-list", "-n1", co]
@@ -481,9 +482,10 @@ function archiveGitRemote (p, u, co, cb) {
       return next(er)
     }
     log.verbose("git rev-list -n1 " + co, stdout)
-    var parsed = url.parse(u)
+    var parsed = url.parse(origUrl)
     parsed.hash = stdout
     resolved = url.format(parsed)
+    log.verbose('resolved git url', resolved)
     next()
   })
 
@@ -712,7 +714,7 @@ function addNameVersion (name, ver, data, cb) {
       if (!er) readJson( path.join( npm.cache, name, ver
                                   , "package", "package.json" )
                        , function (er, data) {
-          if (er && er.code !== "ENOENT") return cb(er)
+          if (er && er.code !== "ENOENT" && er.code !== "ENOTDIR") return cb(er)
           if (er) return fetchit()
           return cb(null, data)
         })
@@ -1071,6 +1073,7 @@ function lockFileName (u) {
 }
 
 var madeCache = false
+var myLocks = {}
 function lock (u, cb) {
   // the cache dir needs to exist already for this.
   if (madeCache) then()
@@ -1085,10 +1088,16 @@ function lock (u, cb) {
                , wait: npm.config.get("cache-lock-wait") }
     var lf = lockFileName(u)
     log.verbose("lock", u, lf)
-    lockFile.lock(lf, opts, cb)
+    lockFile.lock(lf, opts, function(er) {
+      if (!er) myLocks[lf] = true
+      cb(er)
+    })
   }
 }
 
 function unlock (u, cb) {
+  var lf = lockFileName(u)
+  if (!myLocks[lf]) return process.nextTick(cb)
+  myLocks[lf] = false
   lockFile.unlock(lockFileName(u), cb)
 }
diff --git a/deps/npm/lib/dedupe.js b/deps/npm/lib/dedupe.js
index 51c6fca90f..bd0056e99b 100644
--- a/deps/npm/lib/dedupe.js
+++ b/deps/npm/lib/dedupe.js
@@ -35,8 +35,16 @@ function dedupe (args, silent, cb) {
 
 function dedupe_ (dir, filter, unavoidable, dryrun, silent, cb) {
   readInstalled(path.resolve(dir), {}, null, function (er, data, counter) {
+    if (er) {
+      return cb(er)
+    }
+
+    if (!data) {
+      return cb()
+    }
+
     // find out which things are dupes
-    var dupes = Object.keys(counter).filter(function (k) {
+    var dupes = Object.keys(counter || {}).filter(function (k) {
       if (filter.length && -1 === filter.indexOf(k)) return false
       return counter[k] > 1 && !unavoidable[k]
     }).reduce(function (s, k) {
@@ -265,7 +273,7 @@ function readInstalled (dir, counter, parent, cb) {
   })
 
   readJson(path.resolve(dir, "package.json"), function (er, data) {
-    if (er && er.code !== "ENOENT") return cb(er)
+    if (er && er.code !== "ENOENT" && er.code !== "ENOTDIR") return cb(er)
     if (er) return cb() // not a package, probably.
     counter[data.name] = counter[data.name] || 0
     counter[data.name]++
@@ -294,6 +302,9 @@ function readInstalled (dir, counter, parent, cb) {
 
   fs.readdir(path.resolve(dir, "node_modules"), function (er, c) {
     children = c || [] // error is ok, just means no children.
+    children = children.filter(function (p) {
+      return !p.match(/^[\._-]/)
+    })
     next()
   })
 
diff --git a/deps/npm/lib/install.js b/deps/npm/lib/install.js
index ef5ef14184..5f97dc43ad 100644
--- a/deps/npm/lib/install.js
+++ b/deps/npm/lib/install.js
@@ -61,6 +61,7 @@ install.completion = function (opts, cb) {
 var npm = require("./npm.js")
   , semver = require("semver")
   , readJson = require("read-package-json")
+  , readInstalled = require("read-installed")
   , log = require("npmlog")
   , path = require("path")
   , fs = require("graceful-fs")
@@ -77,12 +78,24 @@ function install (args, cb_) {
   function cb (er, installed) {
     if (er) return cb_(er)
 
-    var tree = treeify(installed || [])
-      , pretty = prettify(tree, installed).trim()
+    findPeerInvalid(where, function (er, problem) {
+      if (er) return cb_(er)
 
-    if (pretty) console.log(pretty)
-    if (er) return cb_(er)
-    save(where, installed, tree, pretty, cb_)
+      if (problem) {
+        var peerInvalidError = new Error("The package " + problem.name +
+          " does not satisfy its siblings' peerDependencies requirements!")
+        peerInvalidError.code = "EPEERINVALID"
+        peerInvalidError.packageName = problem.name
+        peerInvalidError.peersDepending = problem.peersDepending
+        return cb(peerInvalidError)
+      }
+
+      var tree = treeify(installed || [])
+        , pretty = prettify(tree, installed).trim()
+
+      if (pretty) console.log(pretty)
+      save(where, installed, tree, pretty, cb_)
+    })
   }
 
   // the /path/to/node_modules/..
@@ -148,7 +161,7 @@ function install (args, cb_) {
     // initial "family" is the name:version of the root, if it's got
     // a package.json file.
     readJson(path.resolve(where, "package.json"), function (er, data) {
-      if (er && er.code !== "ENOENT") return cb(er)
+      if (er && er.code !== "ENOENT" && er.code !== "ENOTDIR") return cb(er)
       if (er) data = null
       var context = { family: {}
                     , ancestors: {}
@@ -164,6 +177,45 @@ function install (args, cb_) {
   })
 }
 
+function findPeerInvalid (where, cb) {
+  readInstalled(where, function (er, data) {
+    if (er) return cb(er)
+
+    cb(null, findPeerInvalid_(data.dependencies, []))
+  })
+}
+
+function findPeerInvalid_ (packageMap, fpiList) {
+  if (fpiList.indexOf(packageMap) !== -1)
+    return
+
+  fpiList.push(packageMap)
+
+  for (var packageName in packageMap) {
+    var pkg = packageMap[packageName]
+
+    if (pkg.peerInvalid) {
+      var peersDepending = {};
+      for (peerName in packageMap) {
+        var peer = packageMap[peerName]
+        if (peer.peerDependencies && peer.peerDependencies[packageName]) {
+          peersDepending[peer.name + "@" + peer.version] =
+            peer.peerDependencies[packageName]
+        }
+      }
+      return { name: pkg.name, peersDepending: peersDepending }
+    }
+
+    if (pkg.dependencies) {
+      var invalid = findPeerInvalid_(pkg.dependencies, fpiList)
+      if (invalid)
+        return invalid
+    }
+  }
+
+  return null
+}
+
 // reads dependencies for the package at "where". There are several cases,
 // depending on our current state and the package's configuration:
 //
@@ -186,7 +238,7 @@ function readDependencies (context, where, opts, cb) {
     if (er)  return cb(er)
 
     if (opts && opts.dev) {
-      if (!data.dependencies) data.dependencies = {};
+      if (!data.dependencies) data.dependencies = {}
       Object.keys(data.devDependencies || {}).forEach(function (k) {
         data.dependencies[k] = data.devDependencies[k]
       })
@@ -456,7 +508,7 @@ function installManyTop_ (what, where, context, cb) {
       return path.resolve(nm, p, "package.json")
     }), function (jsonfile, cb) {
       readJson(jsonfile, function (er, data) {
-        if (er && er.code !== "ENOENT") return cb(er)
+        if (er && er.code !== "ENOENT" && er.code !== "ENOTDIR") return cb(er)
         if (er) return cb(null, [])
         return cb(null, [[data.name, data.version]])
       })
@@ -536,9 +588,15 @@ function targetResolver (where, context, deps) {
 
   if (!context.explicit) fs.readdir(nm, function (er, inst) {
     if (er) return alreadyInstalledManually = []
+
+    // don't even mess with non-package looking things
+    inst = inst.filter(function (p) {
+      return !p.match(/^[\._-]/)
+    })
+
     asyncMap(inst, function (pkg, cb) {
       readJson(path.resolve(nm, pkg, "package.json"), function (er, d) {
-        if (er && er.code !== "ENOENT") return cb(er)
+        if (er && er.code !== "ENOENT" && er.code !== "ENOTDIR") return cb(er)
         // error means it's not a package, most likely.
         if (er) return cb(null, [])
 
@@ -657,7 +715,7 @@ function localLink (target, where, context, cb) {
     , parent = context.parent
 
   readJson(jsonFile, function (er, data) {
-    if (er && er.code !== "ENOENT") return cb(er)
+    if (er && er.code !== "ENOENT" && er.code !== "ENOTDIR") return cb(er)
     if (er || data._id === target._id) {
       if (er) {
         install( path.resolve(npm.globalDir, "..")
@@ -705,14 +763,36 @@ function resultList (target, where, parentId) {
          , target._from ]
 }
 
+// name => install locations
+var installOnesInProgress = Object.create(null)
+
+function isIncompatibleInstallOneInProgress(target, where) {
+  return target.name in installOnesInProgress &&
+         installOnesInProgress[target.name].indexOf(where) !== -1
+}
+
 function installOne_ (target, where, context, cb) {
   var nm = path.resolve(where, "node_modules")
     , targetFolder = path.resolve(nm, target.name)
-    , prettyWhere = path.relative(process.cwd, where)
+    , prettyWhere = path.relative(process.cwd(), where)
     , parent = context.parent
 
   if (prettyWhere === ".") prettyWhere = null
 
+  if (isIncompatibleInstallOneInProgress(target, where)) {
+    var prettyTarget = path.relative(process.cwd(), targetFolder)
+
+    // just call back, with no error.  the error will be detected in the
+    // final check for peer-invalid dependencies
+    return cb()
+  }
+
+  if (!(target.name in installOnesInProgress)) {
+    installOnesInProgress[target.name] = []
+  }
+  installOnesInProgress[target.name].push(where)
+  var indexOfIOIP = installOnesInProgress[target.name].length - 1
+
   chain
     ( [ [checkEngine, target]
       , [checkPlatform, target]
@@ -720,7 +800,10 @@ function installOne_ (target, where, context, cb) {
       , [checkGit, targetFolder]
       , [write, target, targetFolder, context] ]
     , function (er, d) {
+        installOnesInProgress[target.name].splice(indexOfIOIP, 1)
+
         if (er) return cb(er)
+
         d.push(resultList(target, where, parent && parent._id))
         cb(er, d)
       }
@@ -786,14 +869,14 @@ function checkList (value, list) {
     list = [list]
   }
   if (list.length === 1 && list[0] === "any") {
-    return true;
+    return true
   }
   for (var i = 0; i < list.length; ++i) {
     tmp = list[i]
     if (tmp[0] === '!') {
       tmp = tmp.slice(1)
       if (tmp === value) {
-        return false;
+        return false
       }
       ++blc
     } else {
@@ -933,7 +1016,7 @@ function write (target, targetFolder, context, cb_) {
 
         if (peerDeps.length > 0) {
           actions.push(
-            [ installManyAndBuild, peerDeps, pdTargetFolder, pdContext ]
+            [ installMany, peerDeps, pdTargetFolder, pdContext ]
           )
         }
 
diff --git a/deps/npm/lib/link.js b/deps/npm/lib/link.js
index e9127960c5..4ecd64ac3b 100644
--- a/deps/npm/lib/link.js
+++ b/deps/npm/lib/link.js
@@ -20,7 +20,7 @@ link.completion = function (opts, cb) {
   var dir = npm.globalDir
   fs.readdir(dir, function (er, files) {
     cb(er, files.filter(function (f) {
-      return f.charAt(0) !== "."
+      return !f.match(/^[\._-]/)
     }))
   })
 }
diff --git a/deps/npm/lib/outdated.js b/deps/npm/lib/outdated.js
index bb9f93eadf..e3ef5b1e45 100644
--- a/deps/npm/lib/outdated.js
+++ b/deps/npm/lib/outdated.js
@@ -76,7 +76,7 @@ function outdated_ (args, dir, parentHas, cb) {
 
   var deps = null
   readJson(path.resolve(dir, "package.json"), function (er, d) {
-    if (er && er.code !== "ENOENT") return cb(er)
+    if (er && er.code !== "ENOENT" && er.code !== "ENOTDIR") return cb(er)
     deps = (er) ? true : (d.dependencies || {})
     return next()
   })
@@ -87,10 +87,13 @@ function outdated_ (args, dir, parentHas, cb) {
       has = Object.create(parentHas)
       return next()
     }
+    pkgs = pkgs.filter(function (p) {
+      return !p.match(/^[\._-]/)
+    })
     asyncMap(pkgs, function (pkg, cb) {
       var jsonFile = path.resolve(dir, "node_modules", pkg, "package.json")
       readJson(jsonFile, function (er, d) {
-        if (er && er.code !== "ENOENT") return cb(er)
+        if (er && er.code !== "ENOENT" && er.code !== "ENOTDIR") return cb(er)
         cb(null, er ? [] : [[d.name, d.version]])
       })
     }, function (er, pvs) {
diff --git a/deps/npm/lib/publish.js b/deps/npm/lib/publish.js
index e22719f561..8de09e5a1b 100644
--- a/deps/npm/lib/publish.js
+++ b/deps/npm/lib/publish.js
@@ -32,7 +32,7 @@ function publish (args, isRetry, cb) {
   var arg = args[0]
   // if it's a local folder, then run the prepublish there, first.
   readJson(path.resolve(arg, "package.json"), function (er, data) {
-    if (er && er.code !== "ENOENT") return cb(er)
+    if (er && er.code !== "ENOENT" && er.code !== "ENOTDIR") return cb(er)
     // error is ok.  could be publishing a url or tarball
     // however, that means that we will not have automatically run
     // the prepublish script, since that gets run when adding a folder
diff --git a/deps/npm/lib/run-script.js b/deps/npm/lib/run-script.js
index d509cc86e0..0808f2edd6 100644
--- a/deps/npm/lib/run-script.js
+++ b/deps/npm/lib/run-script.js
@@ -25,7 +25,7 @@ runScript.completion = function (opts, cb) {
     // or a package, in which case, complete against its scripts
     var json = path.join(npm.prefix, "package.json")
     return readJson(json, function (er, d) {
-      if (er && er.code !== "ENOENT") return cb(er)
+      if (er && er.code !== "ENOENT" && er.code !== "ENOTDIR") return cb(er)
       if (er) d = {}
       var scripts = Object.keys(d.scripts || {})
       console.error("local scripts", scripts)
@@ -36,7 +36,7 @@ runScript.completion = function (opts, cb) {
       var pkgDir = path.resolve( pref, "node_modules"
                                , argv[2], "package.json" )
       readJson(pkgDir, function (er, d) {
-        if (er && er.code !== "ENOENT") return cb(er)
+        if (er && er.code !== "ENOENT" && er.code !== "ENOTDIR") return cb(er)
         if (er) d = {}
         var scripts = Object.keys(d.scripts || {})
         return cb(null, scripts)
@@ -57,7 +57,7 @@ runScript.completion = function (opts, cb) {
 
   if (npm.config.get("global")) scripts = [], next()
   else readJson(path.join(npm.prefix, "package.json"), function (er, d) {
-    if (er && er.code !== "ENOENT") return cb(er)
+    if (er && er.code !== "ENOENT" && er.code !== "ENOTDIR") return cb(er)
     d = d || {}
     scripts = Object.keys(d.scripts || {})
     next()
diff --git a/deps/npm/lib/uninstall.js b/deps/npm/lib/uninstall.js
index 275088ef70..bebc2300bf 100644
--- a/deps/npm/lib/uninstall.js
+++ b/deps/npm/lib/uninstall.js
@@ -30,7 +30,7 @@ function uninstall (args, cb) {
   // remove this package from the global space, if it's installed there
   if (npm.config.get("global")) return cb(uninstall.usage)
   readJson(path.resolve(npm.prefix, "package.json"), function (er, pkg) {
-    if (er && er.code !== "ENOENT") return cb(er)
+    if (er && er.code !== "ENOENT" && er.code !== "ENOTDIR") return cb(er)
     if (er) return cb(uninstall.usage)
     uninstall_( [pkg.name]
               , npm.dir
diff --git a/deps/npm/lib/unpublish.js b/deps/npm/lib/unpublish.js
index c0056e7768..0e48ab72da 100644
--- a/deps/npm/lib/unpublish.js
+++ b/deps/npm/lib/unpublish.js
@@ -56,7 +56,7 @@ function unpublish (args, cb) {
     // read the package name and version out of that.
     var cwdJson = path.join(process.cwd(), "package.json")
     return readJson(cwdJson, function (er, data) {
-      if (er && er.code !== "ENOENT") return cb(er)
+      if (er && er.code !== "ENOENT" && er.code !== "ENOTDIR") return cb(er)
       if (er) return cb("Usage:\n"+unpublish.usage)
       gotProject(data.name, data.version, cb)
     })
diff --git a/deps/npm/lib/utils/error-handler.js b/deps/npm/lib/utils/error-handler.js
index 7fabd69990..51394f10ce 100644
--- a/deps/npm/lib/utils/error-handler.js
+++ b/deps/npm/lib/utils/error-handler.js
@@ -203,6 +203,14 @@ function errorHandler (er) {
               ].join("\n"))
     break
 
+  case "EPEERINVALID":
+    var peerErrors = Object.keys(er.peersDepending).map(function (peer) {
+      return "Peer " + peer + " wants " + er.packageName + "@"
+        + er.peersDepending[peer]
+    })
+    log.error("peerinvalid", [er.message].concat(peerErrors).join("\n"))
+    break
+
   case "ENOTSUP":
     if (er.required) {
       log.error("notsup", [er.message
diff --git a/deps/npm/lib/utils/lifecycle.js b/deps/npm/lib/utils/lifecycle.js
index ba5cee5dae..3f0042f819 100644
--- a/deps/npm/lib/utils/lifecycle.js
+++ b/deps/npm/lib/utils/lifecycle.js
@@ -221,6 +221,9 @@ function makeEnv (data, prefix, env) {
 
   for (var i in data) if (i.charAt(0) !== "_") {
     var envKey = (prefix+i).replace(/[^a-zA-Z0-9_]/g, '_')
+    if (i === "readme") {
+      continue
+    }
     if (data[i] && typeof(data[i]) === "object") {
       try {
         // quick and dirty detection for cyclical structures
diff --git a/deps/npm/lib/utils/tar.js b/deps/npm/lib/utils/tar.js
index 3a84bbdc13..c96c4c46f2 100644
--- a/deps/npm/lib/utils/tar.js
+++ b/deps/npm/lib/utils/tar.js
@@ -27,32 +27,57 @@ if (process.env.SUDO_UID && myUid === 0) {
 exports.pack = pack
 exports.unpack = unpack
 
-function pack (targetTarball, folder, pkg, dfc, cb) {
-  log.verbose("tar pack", [targetTarball, folder])
+function pack (tarball, folder, pkg, dfc, cb) {
+  log.verbose("tar pack", [tarball, folder])
   if (typeof cb !== "function") cb = dfc, dfc = false
 
-  log.verbose("tarball", targetTarball)
+  log.verbose("tarball", tarball)
   log.verbose("folder", folder)
 
   if (dfc) {
     // do fancy crap
     return lifecycle(pkg, "prepublish", folder, function (er) {
       if (er) return cb(er)
-      pack_(targetTarball, folder, pkg, cb)
+      pack_(tarball, folder, pkg, cb)
     })
   } else {
-    pack_(targetTarball, folder, pkg, cb)
+    pack_(tarball, folder, pkg, cb)
   }
 }
 
-function pack_ (targetTarball, folder, pkg, cb_) {
+function pack_ (tarball, folder, pkg, cb_) {
+  var tarballLock = false
+    , folderLock = false
+
   function cb (er) {
-    unlock(targetTarball, function () {
-      return cb_(er)
-    })
+    if (folderLock)
+      unlock(folder, function() {
+        folderLock = false
+        cb(er)
+      })
+    else if (tarballLock)
+      unlock(tarball, function() {
+        tarballLock = false
+        cb(er)
+      })
+    else
+      cb_(er)
   }
-  lock(targetTarball, function (er) {
+
+  lock(folder, function(er) {
     if (er) return cb(er)
+    folderLock = true
+    next()
+  })
+
+  lock(tarball, function (er) {
+    if (er) return cb(er)
+    tarballLock = true
+    next()
+  })
+
+  function next () {
+    if (!tarballLock || !folderLock) return
 
     new Packer({ path: folder, type: "Directory", isDirectory: true })
       .on("error", function (er) {
@@ -67,21 +92,21 @@ function pack_ (targetTarball, folder, pkg, cb_) {
       // non-compliant tar implementations.
       .pipe(tar.Pack({ noProprietary: !npm.config.get("proprietary-attribs") }))
       .on("error", function (er) {
-        if (er) log.error("tar.pack", "tar creation error", targetTarball)
+        if (er) log.error("tar.pack", "tar creation error", tarball)
         cb(er)
       })
       .pipe(zlib.Gzip())
       .on("error", function (er) {
-        if (er) log.error("tar.pack", "gzip error "+targetTarball)
+        if (er) log.error("tar.pack", "gzip error "+tarball)
         cb(er)
       })
-      .pipe(fstream.Writer({ type: "File", path: targetTarball }))
+      .pipe(fstream.Writer({ type: "File", path: tarball }))
       .on("error", function (er) {
-        if (er) log.error("tar.pack", "Could not write "+targetTarball)
+        if (er) log.error("tar.pack", "Could not write "+tarball)
         cb(er)
       })
       .on("close", cb)
-  })
+  }
 }
 
 
@@ -101,18 +126,41 @@ function unpack (tarball, unpackTarget, dMode, fMode, uid, gid, cb) {
 function unpack_ ( tarball, unpackTarget, dMode, fMode, uid, gid, cb_ ) {
   var parent = path.dirname(unpackTarget)
     , base = path.basename(unpackTarget)
+    , folderLock
+    , tarballLock
 
   function cb (er) {
-    unlock(unpackTarget, function () {
-      return cb_(er)
-    })
+    if (folderLock)
+      unlock(unpackTarget, function() {
+        folderLock = false
+        cb(er)
+      })
+    else if (tarballLock)
+      unlock(tarball, function() {
+        tarballLock = false
+        cb(er)
+      })
+    else
+      cb_(er)
   }
 
   lock(unpackTarget, function (er) {
     if (er) return cb(er)
-    rmGunz()
+    folderLock = true
+    next()
   })
 
+  lock(tarball, function (er) {
+    if (er) return cb(er)
+    tarballLock = true
+    next()
+  })
+
+  function next() {
+    if (!tarballLock || !folderLock) return
+    rmGunz()
+  }
+
   function rmGunz () {
     rm(unpackTarget, function (er) {
       if (er) return cb(er)