Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Cannot install private github repository with https #2054

Closed
bencergazda opened this issue Oct 27, 2020 · 3 comments
Closed

Cannot install private github repository with https #2054

bencergazda opened this issue Oct 27, 2020 · 3 comments
Assignees
@wraithgar
Labels
Bug thing that needs fixing Release 7.x work is associated with a specific npm 7 release
Milestone
OSS - Sprint 22

Comments

@bencergazda
Copy link

npm install --verbose with package.json containing

"dependencies": {
    "@SOME_ORG/SOME_PRIVATE_REPO": "git+https://{token}:[email protected]/SOME_ORG/SOME_PRIVATE_REPO.git"
}

Current Behavior:

...
npm http fetch GET 404 https://codeload.github.com/SOME_ORG/SOME_PRIVATE_REPO/tar.gz/[commit_hash] 323ms
...
npm info ok

It uses SSH to connect, and not the given token.

  • if no SSH is configured, it fails to install the repo even if the token is valid
  • if SSH is configured, it installs the repo even if the token is invalid

Expected Behavior:

It should use the credentials from the package URL. It should

  • install the package with the given token, even is SSH is not configured
  • if the given token is invalid, throw npm ERR! remote: Invalid username or password. error even if it could use SSH

It works as expected with [email protected]

Steps To Reproduce:

  1. npm install -g npm@7
  2. npm install
  3. you should see the current behavior
  4. npm install -g npm@6
  5. npm install
  6. it should work OK

Environment:

  • OS: Ubuntu 18.04.5 and Mac OS 10.15.7
  • Node: 15.0.1
  • npm: 7.0.5
@bencergazda bencergazda added Bug thing that needs fixing Needs Triage needs review for next steps Release 7.x work is associated with a specific npm 7 release labels Oct 27, 2020
@darcyclarke darcyclarke changed the title Cannot install private github repository with https <title> Cannot install private github repository with https Oct 27, 2020
@darcyclarke darcyclarke removed the Needs Triage needs review for next steps label Jan 8, 2021
@darcyclarke darcyclarke added this to the OSS - Sprint 22 milestone Jan 8, 2021
@darcyclarke darcyclarke mentioned this issue Jan 8, 2021
Closed
isaacs added a commit to npm/pacote that referenced this issue Jan 20, 2021
@isaacs
Preserve git+https auth when provided
e0e10f1 
This makes pacote use the git+https: url as the resolved value for known
hosts when auth is provided.  When auth is not provided, we store the
ssh url as the resolved value, in order to maintain a canonical save
value that is never git:// for known hosts.

In order to fully fix npm/cli#2054, we will also need to have
@npmcli/arborist store the git+https url in the package-lock.json and
package.json if https auth is provided.
@isaacs isaacs mentioned this issue Jan 20, 2021
Closed
@isaacs
Copy link
Contributor

isaacs commented Jan 20, 2021

The change in npm/pacote#61 is the first half of this. It will tell pacote to use git+https and not fall back to ssh, if https auth is provided. It will also use git+https as the resolved value in these cases.

The second part of the change will be fixed in @npmcli/arborist, by having it store git+https in the package{,-lock}.json files (instead of the shortcut or git+ssh) for known hosts when https auth is present.

isaacs added a commit to npm/arborist that referenced this issue Jan 20, 2021
@isaacs
Preserve git+https auth when provided
f2eb793 
This makes Arborist use the git+https: url as the saved value in
package-lock.json and package.json files for known git hosts when http
auth is provided.  When auth is not provided, we store the canonical ssh
url in package-lock.json, and the more human-friendly shortcut in
package.json, in order to maintain a canonical save value that is never
git:// for known hosts.

This is the second part of the fix for npm/cli#2054.
@isaacs isaacs mentioned this issue Jan 20, 2021
Closed
isaacs added a commit to npm/arborist that referenced this issue Jan 20, 2021
@isaacs
Preserve git+https auth when provided
197948c 
This makes Arborist use the git+https: url as the saved value in
package-lock.json and package.json files for known git hosts when http
auth is provided.  When auth is not provided, we store the canonical ssh
url in package-lock.json, and the more human-friendly shortcut in
package.json, in order to maintain a canonical save value that is never
git:// for known hosts.

This is the second part of the fix for npm/cli#2054.
isaacs added a commit to npm/arborist that referenced this issue Jan 20, 2021
@isaacs
Preserve git+https auth when provided
6356a6f 
This makes Arborist use the git+https: url as the saved value in
package-lock.json and package.json files for known git hosts when http
auth is provided.  When auth is not provided, we store the canonical ssh
url in package-lock.json, and the more human-friendly shortcut in
package.json, in order to maintain a canonical save value that is never
git:// for known hosts.

This is the second part of the fix for npm/cli#2054.
isaacs added a commit to npm/arborist that referenced this issue Jan 21, 2021
@isaacs
Preserve git+https auth when provided
9989f4f 
This makes Arborist use the git+https: url as the saved value in
package-lock.json and package.json files for known git hosts when http
auth is provided.  When auth is not provided, we store the canonical ssh
url in package-lock.json, and the more human-friendly shortcut in
package.json, in order to maintain a canonical save value that is never
git:// for known hosts.

This is the second part of the fix for npm/cli#2054.

PR-URL: #205
Credit: @isaacs
Close: #205
Reviewed-by: @wraithgar
@bencergazda
Copy link
Author

Works great, thank you!

@roman-r-m roman-r-m mentioned this issue Aug 24, 2021
Closed
@pyon123
Copy link

pyon123 commented Jun 14, 2023

@isaacs @bencergazda I am having the exactly same issue, but not sure how to solve this. would you like to explain in more detail?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@wraithgar wraithgar

Labels
Bug thing that needs fixing Release 7.x work is associated with a specific npm 7 release
Projects
None yet
Milestone
OSS - Sprint 22
Development

Successfully merging a pull request may close this issue.

Preserve git+https auth when provided npm/pacote
5 participants
@isaacs @wraithgar @darcyclarke @bencergazda @pyon123