ds300 / ds300/patch-package

New patch fails with private registries (RFC)

Open
#318 5 comments 14 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
11.2k
Forks
325
PR merge metrics
No merged PRs in 30d

Description

We've been noticing an issue sporadically with writing new patches and having a private NPM registry. I can reproduce the issue reliably, and I can fix it locally, but I'm not sure what the underlying cause is here. Hoping someone can provide guidance on a better fix for this. If there isn't I'm happy to PR my proposal below.

## Reproducing the issue

have a `yarn` repo with an `.npmrc` in it as follows:

```
registry=https://my-private-registry-host.example/repository/npm
always-auth=true
```

and an `~/.npmrc` as follows:

```
//my-private-registry-host.example/repository/npm/:_auth="myNPMauthTOKEN"
```

pick any package in node_modules that has not had a patch written for it before and run `yarn patch-package the-package`:

```
▶ yarn patch-package yazl
yarn run v1.22.4
$ /path/to/repo/node_modules/.bin/patch-package the-package
patch-package 6.4.7+cd069d4b
• Creating temporary folder
• Installing the-package@2.5.1 with yarn
warning package.json: No license field
warning No license field
error An unexpected error occurred: "https://my-private-registry-host.example/repository/npm/the-package/-/the-package-2.5.1.tgz: Request failed \"401 Unauthorized\"".

<<...some garbage output (console.log of some buffers it seems)...>>
```

If I add some more logs ahead of the `yarn install` that patch-package does, the output seems to make sense:

```
# ls -la in the tmpRepoPath
# the copied .npmrc is as noted above for the project one
total 16
drwx------ 4 me staff 128 19 May 16:07 .
drwx------@ 478 me staff 15296 19 May 16:07 ..
-rw-r--r-- 1 me staff 75 19 May 16:07 .npmrc
-rw-r--r-- 1 me staff 454 19 May 16:07 package.json

# cat package.json in the tmpRepoPath
{"dependencies":{"the-package":"https://my-private-registry-host.example/repository/npm/the-package/-/the-package-2.5.1.tgz#a3d65d3dd659a5b0937850e8609f22fffa2b5c35"},"resolutions":{...}}
```

## The Fix

I can fix the 401 by adding `--registry https://my-private-registry-host.example/repository/npm` to the yarn install command that patch-package builds. It's not clear why this resolves it, but I assume it has something to do with scoped auth tokens (in my $HOME/.npmrc).

## Proposal

I propose making a change to allow passthrough flags that allow me to specify the registry I want to build the patch against.

In this case I'd run `yarn patch-package the-package --registry https://my-private-registry-host.example/repository/npm` and patch-package would add that flag to the install command.

I'd love to find a better fix for this but the underlying cause escapes me.

```
▶ yarn --version
1.22.4
```

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.