npm / npm/cli

[BUG] npm does not authenticate against internal registry when using git dependencies

Open
#5,919 1 comment 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Bug Needs Triage Release 8.x
Dominant language
JavaScript
Stars
10.1k
Forks
4.7k
Avg merge
2d 2h
Merged PRs (30d)
19

Description

Is there an existing issue for this?
  • I have searched the existing issues
This issue exists in the latest npm version
  • I am using the latest npm
Current Behavior

npm install ignores authentication settings in .npmrc when fetching dependencies of a git dependency.
This results in failure message (See below) and an amount of 401 errors logged on the registry server.

Expected Behavior

npm install should always use authentication settings when so instructed through .npmrc

Steps To Reproduce

Create a package.json like this:

{
  "name": "npm-test",
  "version": "1.0.0",
  "private": true,
  "dependencies": {
    "amqplib": "git+https://github.com/amqp-node/amqplib.git"
  }
}

Configure npm to use an internal registry (I'm using Sonatype nexus)

registry=https://nexusrepo.xxxxxxxxxxxxx/repository/npm-proxy/
//nexusrepo.xxxxxxxxxxxxx/:always-auth=true
//nexusrepo.xxxxxxxxxxxxx/:_authToken=NpmToken.XXXXXXXXXXXXXXXXXXX

Clear the local npm cache

npm cache clean --force

Perform npm install

npm install
npm ERR! code 1
npm ERR! git dep preparation failed
npm ERR! command /home/nils/.nvm/versions/node/v18.12.1/bin/node /home/nils/.nvm/versions/node/v18.12.1/lib/node_modules/npm/bin/npm-cli.js install --force --cache=/home/nils/.npm --prefer-offline=false --prefer-online=false --offline=false --no-progress --no-save --no-audit --include=dev --include=peer --include=optional --no-package-lock-only --no-dry-run
npm ERR! npm WARN using --force Recommended protections disabled.
npm ERR! npm ERR! code E401
npm ERR! npm ERR! Unable to authenticate, need: BASIC realm="Sonatype Nexus Repository Manager"
npm ERR! 
npm ERR! npm ERR! A complete log of this run can be found in:
npm ERR! npm ERR!     /home/nils/.npm/_logs/2022-12-05T15_48_01_444Z-debug-0.log

npm ERR! A complete log of this run can be found in:
npm ERR!     /home/nils/.npm/_logs/2022-12-05T15_47_57_729Z-debug-0.log
Environment
  • npm: 8.19.2
  • Node.js: v18.12.1
  • OS Name: GNU/Linux (Tested on Ubuntu 20 & Debian SID)
  • System Model Name: N/A
  • npm config:
; "project" config from /home/nils/tmp/npm-test/.npmrc

//nexusrepo.redacted/:_authToken = (protected) 
//nexusrepo.redacted/:always-auth = true 
registry = "https://nexusrepo.redacted/repository/npm-focus/" 

; node bin location = /home/nils/.nvm/versions/node/v18.12.1/bin/node
; node version = v18.12.1
; npm local prefix = /home/nils/tmp/npm-test
; npm version = 8.19.2
; cwd = /home/nils/tmp/npm-test
; HOME = /home/nils
; Run `npm config ls -l` to show all defaults.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the package.json, .npmrc configuration, and npm install reproduction described in the issue, using the reported git dependency and internal registry. Trace how authentication settings are handled during git dependency preparation. Done means npm install uses the configured credentials and completes without the reported 401 errors.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, node.js
Domain
authentication, cli, tooling
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.