New patch fails with private registries (RFC)
- Dominant language
- TypeScript
- Stars
- 11.2k
- Forks
- 325
- PR merge metrics
- No merged PRs in 30d
Description
We've been noticing an issue sporadically with writing new patches and having a private NPM registry. I can reproduce the issue reliably, and I can fix it locally, but I'm not sure what the underlying cause is here. Hoping someone can provide guidance on a better fix for this. If there isn't I'm happy to PR my proposal below.
## Reproducing the issue
have a `yarn` repo with an `.npmrc` in it as follows:
```
registry=https://my-private-registry-host.example/repository/npm
always-auth=true
```
and an `~/.npmrc` as follows:
```
//my-private-registry-host.example/repository/npm/:_auth="myNPMauthTOKEN"
```
pick any package in node_modules that has not had a patch written for it before and run `yarn patch-package the-package`:
```
▶ yarn patch-package yazl
yarn run v1.22.4
$ /path/to/repo/node_modules/.bin/patch-package the-package
patch-package 6.4.7+cd069d4b
• Creating temporary folder
• Installing the-package@2.5.1 with yarn
warning package.json: No license field
warning No license field
error An unexpected error occurred: "https://my-private-registry-host.example/repository/npm/the-package/-/the-package-2.5.1.tgz: Request failed \"401 Unauthorized\"".
<<...some garbage output (console.log of some buffers it seems)...>>
```
If I add some more logs ahead of the `yarn install` that patch-package does, the output seems to make sense:
```
# ls -la in the tmpRepoPath
# the copied .npmrc is as noted above for the project one
total 16
drwx------ 4 me staff 128 19 May 16:07 .
drwx------@ 478 me staff 15296 19 May 16:07 ..
-rw-r--r-- 1 me staff 75 19 May 16:07 .npmrc
-rw-r--r-- 1 me staff 454 19 May 16:07 package.json
# cat package.json in the tmpRepoPath
{"dependencies":{"the-package":"https://my-private-registry-host.example/repository/npm/the-package/-/the-package-2.5.1.tgz#a3d65d3dd659a5b0937850e8609f22fffa2b5c35"},"resolutions":{...}}
```
## The Fix
I can fix the 401 by adding `--registry https://my-private-registry-host.example/repository/npm` to the yarn install command that patch-package builds. It's not clear why this resolves it, but I assume it has something to do with scoped auth tokens (in my $HOME/.npmrc).
## Proposal
I propose making a change to allow passthrough flags that allow me to specify the registry I want to build the patch against.
In this case I'd run `yarn patch-package the-package --registry https://my-private-registry-host.example/repository/npm` and patch-package would add that flag to the install command.
I'd love to find a better fix for this but the underlying cause escapes me.
```
▶ yarn --version
1.22.4
```
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.