npm / npm/cli

[BUG] port, username and password are lost from npm registry url during "reify" stage

Open
#4,443 8 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Bug Needs Triage Release 8.x
Dominant language
JavaScript
Stars
10.1k
Forks
4.7k
Avg merge
2d 2h
Merged PRs (30d)
19

Description

Is there an existing issue for this?
  • I have searched the existing issues
This issue exists in the latest npm version
  • I am using the latest npm
Current Behavior

I've set up a custom npm registry with verdaccio. This registry is besides some firewall rules, only accessable with a http basic auth. Therefore my repository urls look like:
http://user:pwd@somehost:someport/

If I run npm install now, it downloads all packages, and when it reaches the reify stage, it tries to load some metadata again I guess, but now it tries to donwload it from http://somehost/ <-- username, password and port are lost in the url?
It's not a debug messgae fail, I also checked the network traffic.

It gets stuck on this kind of log messages:
=> => # npm sill tarball no local data for depd@http://somehost/depd/-/depd-1.1.2.tgz. Extracting by manifest.
=> => # npm sill tarball no local data for @sentry/types@http://somehost/@sentry%2ftypes/-/types-6.17.4.tgz. Extracting by manifest.
=> => # npm sill tarball no local data for @sentry/utils@http://somehost/@sentry%2futils/-/utils-6.17.4.tgz. Extracting by manifest.
=> => # npm sill tarball no local data for @sentry/types@http://somehost/@sentry%2ftypes/-/types-6.17.4.tgz. Extracting by manifest.
=> => # npm sill tarball no local data for @sentry/utils@http://somehost/@sentry%2futils/-/utils-6.17.4.tgz. Extracting by manifest.
=> => # npm sill tarball no local data for debug@http://somehost/debug/-/debug-2.6.9.tgz. Extracting by manifest.

Expected Behavior

It should always use the correct version of the npm registry url, and should not "modify" it.

Steps To Reproduce
  1. set up a verdaccio server on a custom port and protect it with uername and password, I guess it would be enough to host it on a custom port already, as the port is also dropped from the url (but haven't tested it)
  2. run npm install
  3. see it fails after download of packages completed, when the "reify" stage starts
Environment
  • npm: 8.5.1 (tried also 8.4.0 and 8.5.0 )
  • Node.js: v16.11.0
  • OS Name: linux

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the issue with npm 8.5.1, Node.js 16.11.0, and a Verdaccio registry using a custom port and HTTP basic authentication. Trace the npm install flow through the reify stage and verify that the registry URL retains its username, password, and port when metadata is loaded; done means the install completes against the configured URL.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, node.js
Domain
cli, tooling
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.