npm / npm/cli

[BUG] Permission denied when installing a git+ssh:// dependency with key loaded by ssh-agent

Open
#3,261 5 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Bug Priority 2 Release 7.x
Dominant language
JavaScript
Stars
10.1k
Forks
4.7k
Avg merge
2d 2h
Merged PRs (30d)
19

Description

Is there an existing issue for this?
  • I have searched the existing issues
Current Behavior

The npm install fails on a git+ssh:// dependency with a ssh-key loaded in ssh-agent on Windows 10 since npm 7.10.0.

Expected Behavior

The dependency should be installed correctly.

Steps To Reproduce

Start ssh-agent and add private key (using Win32-OpenSSH 8.1.0-beta installed with chocolatey)

> ssh-add -l
2048 SHA256:ed0dc338ade1bfdbaab1b5+0e5d29abd4cfd28f04c4 C:\Users\foo\Documents\private-openssh.key (RSA)
> $env:GIT_SSH
C:\Program Files\OpenSSH-Win64\ssh.exe

Install npm dependency from git+ssh:// url will fail

> npm install git+ssh://me@privatehost.com/repo#00ffe8a9e879ae7f52c066e4f4e1eed48cdbc0b4
command git --no-replace-objects ls-remote ssh://me@privatehost.com/repo
npm ERR! me@privatehost.com: Permission denied (publickey).
npm ERR! fatal: Could not read from remote repository.
npm ERR!
npm ERR! Please make sure you have the correct access rights
npm ERR! and the repository exists.

Note that If I run the failed git command in my terminal it works fine

> git --no-replace-objects ls-remote ssh://me@privatehost.com/repo
24df233b1ea977d06a1e49c5d78c30cc3c8d1b4a        HEAD
24df233b1ea977d06a1e49c5d78c30cc3c8d1b4a        refs/heads/master
129da3d3b133b210bc9c7f7525b647f49bf3675a        refs/tags/v0.0.1
cf8051e20551308966116df6568866fba8f81fd4        refs/tags/v0.1.0
...

The bug appeared since npm 7.10.0 and still fails on 7.13.0. It works fine on 7.9.0 and previous version, and fine also on npm 6.14.

If I unload my key from ssh-agent, and put my key in a .ssh\id_rsa the the npm install works fine.

Environment
  • OS: Windows 10
  • Node: 12.22.1
  • npm: 7.13.0

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the npm install git+ssh:// failure on Windows 10 with a key loaded in ssh-agent, then compare the working npm 7.9.0 behavior with npm 7.10.0 and later. Inspect the npm install path that invokes git ls-remote; done means the dependency installs successfully while the key remains in ssh-agent.

Written by the indexing model from the issue text.

Assessment

Tech stack
git, javascript, nodejs
Domain
cli
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.