[BUG] port, username and password are lost from npm registry url during "reify" stage
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 10.1k
- Forks
- 4.7k
- Avg merge
- 2d 2h
- Merged PRs (30d)
- 19
Description
Is there an existing issue for this?
- I have searched the existing issues
This issue exists in the latest npm version
- I am using the latest npm
Current Behavior
I've set up a custom npm registry with verdaccio. This registry is besides some firewall rules, only accessable with a http basic auth. Therefore my repository urls look like:
http://user:pwd@somehost:someport/
If I run npm install now, it downloads all packages, and when it reaches the reify stage, it tries to load some metadata again I guess, but now it tries to donwload it from http://somehost/ <-- username, password and port are lost in the url?
It's not a debug messgae fail, I also checked the network traffic.
It gets stuck on this kind of log messages:
=> => # npm sill tarball no local data for depd@http://somehost/depd/-/depd-1.1.2.tgz. Extracting by manifest.
=> => # npm sill tarball no local data for @sentry/types@http://somehost/@sentry%2ftypes/-/types-6.17.4.tgz. Extracting by manifest.
=> => # npm sill tarball no local data for @sentry/utils@http://somehost/@sentry%2futils/-/utils-6.17.4.tgz. Extracting by manifest.
=> => # npm sill tarball no local data for @sentry/types@http://somehost/@sentry%2ftypes/-/types-6.17.4.tgz. Extracting by manifest.
=> => # npm sill tarball no local data for @sentry/utils@http://somehost/@sentry%2futils/-/utils-6.17.4.tgz. Extracting by manifest.
=> => # npm sill tarball no local data for debug@http://somehost/debug/-/debug-2.6.9.tgz. Extracting by manifest.
Expected Behavior
It should always use the correct version of the npm registry url, and should not "modify" it.
Steps To Reproduce
- set up a verdaccio server on a custom port and protect it with uername and password, I guess it would be enough to host it on a custom port already, as the port is also dropped from the url (but haven't tested it)
- run npm install
- see it fails after download of packages completed, when the "reify" stage starts
Environment
- npm: 8.5.1 (tried also 8.4.0 and 8.5.0 )
- Node.js: v16.11.0
- OS Name: linux
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the issue with npm 8.5.1, Node.js 16.11.0, and a Verdaccio registry using a custom port and HTTP basic authentication. Trace the npm install flow through the reify stage and verify that the registry URL retains its username, password, and port when metadata is loaded; done means the install completes against the configured URL.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, node.js
- Domain
- cli, tooling
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 35/100