相关文章推荐
小百科  ›  [BUG] NPM v7 uses SSH instead of an explicit HTTPS for GitHub repos · Issue #2610 · npm/cli · GitHub
date ssh
高大的卤蛋
3 年前

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement . We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Current Behavior:

When I use a git repository via an HTTP link NPM "takes liberties" with it, which breaks my build: 

$ npm init -y
Wrote to /Users/eugene.lazutkin/Work/temp/package.json:
  "name": "temp",
  "version": "1.0.0",
  "description": "",
  "main": "index.js",
  "scripts": {
    "test": "echo \"Error: no test specified\" && exit 1"
  "keywords": [],
  "author": "",
  "license": "ISC"
$ npm i --save https://github.com/uhop/stream-chain.git
added 1 package, and audited 2 packages in 3s
found 0 vulnerabilities

It produces package-lock.json :

"name" : " temp " , "version" : " 1.0.0 " , "lockfileVersion" : 2 , "requires" : true , "packages" : { "" : { "version" : " 1.0.0 " , "license" : " ISC " , "dependencies" : { "stream-chain" : " github:uhop/stream-chain " "node_modules/stream-chain" : { "version" : " 2.2.4 " , "resolved" : " git+ssh://git@github.com/uhop/stream-chain.git#459f5a1708c138b6e0abaae4cf103c3488e1e78e " , "license" : " BSD-3-Clause " "dependencies" : { "stream-chain" : { "version" : " git+ssh://git@github.com/uhop/stream-chain.git#459f5a1708c138b6e0abaae4cf103c3488e1e78e " , "from" : " stream-chain@github:uhop/stream-chain "

Note that https://github.com/uhop/stream-chain.git was replaced with github:uhop/stream-chain , which is probably OK in this case. But other two links (?) are rewritten from https://github.com/uhop/stream-chain.git to git+ssh://git@github.com/uhop/stream-chain.git , which is clearly bad.

The problem is that a build bot we use in similar situations can access private git repositories using HTTP, but not SSH for security reasons. It fails on an authentication. Rewriting https://github.com/uhop/stream-chain.git to git+ssh://git@github.com/uhop/stream-chain.git is not acceptable for that reasons.

The fix is relatively minor yet unpleasant: we have to replace npm ci with npm i , which takes more time and introduced instabilities with other dependencies.

Expected Behavior:

When running npm ci it should use the original URL with the HTTP authentication instead of SSH.

Steps To Reproduce:

See the description and do the same steps using git repositories (github only?) as dependencies.

Environment:

OS: Mac
Node: 15.7.0
NPM: 7.4.3

koooge, pavel-khritonenko, agentofuser, raineorshine, bryan-hoang, srl295, akhileshbhatia, tstibbs, smelchior, AlbinoDrought, and 188 more reacted with thumbs up emoji hans2520 reacted with eyes emoji All reactions

Just to point it out explicitly:

  • The dependency is set as https://github.com/uhop/stream-chain.git — note https:// part of it.
  • In package-lock.json it is mentioned three times.
  • Two if them as git+ssh://git@github.com/uhop/stream-chain.git#459f5a1708c138b6e0abaae4cf103c3488e1e78e .
  • Note git+ssh://git@github.com part.
  • It definitely tries to access the repository using ssh rather than https protocol and fails.
  • Why is it important?
  • Those protocols have a different way to authenticate a user.
  • Our build environment is not set up for ssh , yet we can use https .

    • I don't know if the bug is specific to GitHub: adding https://github.com/uhop/stream-chain.git was transformed into github:uhop/stream-chain (please peruse my bug report above), and who knows what protocol it assumes. But not all repositories support ssh . We clearly have a bug on our hands.

    I hope I explained the problem better now. Please do not hesitate to ask, if something is left unclear.

    It came to my attention that this is a documented behavior that breaks private repositories and environments without ssh access (from https://blog.npmjs.org/post/626173315965468672/npm-v7-series-beta-release-and-semver-major ):

    Git dependencies on known git hosts (GitHub, BitBucket, etc.) will always attempt to fetch package contents from the relevant tarball CDNs if possible, falling back to git+ssh for private packages. resolved value in package-lock.json will always reflect the git+ssh url value. Saved value in package.json dependencies will always reflect the canonical shorthand value.

    Clearly this is not correct and should be fixed.

    This is a breaking change in npm v7 and prevents anyone using even public packages without ssh keys.

    We have made a fork of an npm package and host it as a public repo. We refer to it using a github: link. In v6 this github link was populated to package-lock.json as well, which worked fine. In v7 it is converted into git+ssh: which fails in our CI/CD pipeline as it doesn't have any ssh keys configured.

    We don't want to add ssh keys to our CI pipeline just to fetch public packages, so I don't see any way we can upgrade. I'd be glad to hear of any workaround.

    Specific example:

    In package.json referring to https://github.com/Vincit/winston-azure-transport : 

        "winston-azure-transport": "github:Vincit/winston-azure-transport#ed07d0685ca601638ab8ebcf660128848dd30215"

    Diff of package-lock.json between npm v6 and v7:
    

         "winston-azure-transport": {
-      "version": "github:Vincit/winston-azure-transport#ed07d0685ca601638ab8ebcf660128848dd30215",
-      "from": "github:Vincit/winston-azure-transport#ed07d0685ca601638ab8ebcf660128848dd30215",```
+      "version": "git+ssh://git@github.com/Vincit/winston-azure-transport.git#ed07d0685ca601638ab8ebcf660128848dd30215",
+      "from": "winston-azure-transport@github:Vincit/winston-azure-transport#ed07d0685ca601638ab8ebcf660128848dd30215",
    

    Our CI now fails with:
    

    npm ERR! Error while executing:
npm ERR! /usr/bin/git ls-remote -h -t ssh://git@github.com/Vincit/winston-azure-transport.git
npm ERR! 
npm ERR! git@github.com: Permission denied (publickey).
npm ERR! fatal: Could not read from remote repository.
npm ERR! 
npm ERR! Please make sure you have the correct access rights
npm ERR! and the repository exists.
npm ERR! 
npm ERR! exited with error code: 128
          
    This is tricky.
    

    We currently keep the https url if auth is set in the url, because presumably you need that auth to access the repo.
    

    The tricky bit is that using https without auth in the url will trigger a prompt to enter a username and password on the command line, which will fail (or at least be confusing and strange) in many cases where an install with ssh would work fine.
    

    If the repo is public, and a git sha is specified in the spec that we're fetching, then we never hit it via git at all; npm will just fetch the tarball from the appropriate CDN url for the known host.  However, if you do not have a git sha in the spec (typically, because there's no lockfile present), then we will have to do a git rev-list to figure out which sha we need to fetch, and that's where it runs into trouble.
    

    Perhaps an approach that both works in build scenarios without ssh keys and for dev machines where ssh keys are present, while minimizing the scenarios where we need to prompt for a username/password for basic auth, would be to do the following for resolving any known-host git spec:
    

  • If the spec has a git sha, just fetch the tarball from the CDN, and we're done.  No git commands needed.  If that fails, continue (either a private package or an invalid git sha).
    • 

  • If the spec is git+https, and has auth specified, save the full git+https url, and only ever access via https.
    • 

  • Attempt to fetch the rev-list via the git+ssh url for the known host/repo.  This will fail if ssh keys are not available, but at least will do so without confusingly prompting for user interaction, in the case of private repos where ssh keys are available.  If that fails, continue.
    • 

  • Attempt to fetch the rev-list via the git+https url for the known host/repo.  This will fail if auth is required for a private package.  (Note: best to just close stdin immediately, so that it fails as quickly as possible.)  But, it will succeed in cases where auth is not required and ssh keys are not available.
    • 

    Maybe we could also add a config to tell npm which git interaction to prefer, thus swapping the order of (3) and (4) above?  --git-prefer=(ssh-first|https-first|ssh-only|https-only), defaulting to ssh-first?  Then you could set npm_config_git_prefer=https-only in the build environment, and have it never try ssh at all.
    
          
    Having an all repo config is probably not the best idea, as packages come in all shapes and forms.
    
I think respecting the installation method provided during the npm install is probably the best approach. If anyone needs ssh or https, they should simply add the package this way.
    
  elazutkin-dynata, bryan-hoang, TwilightOwl, bmacnaughton, gavinvangent, chahn, idleberg, Phebonacci, engelrolling, ralejandre, and 14 more reacted with thumbs up emoji
  binki reacted with confused emoji
      All reactions

    Having an all repo config is probably not the best idea, as packages come in all shapes and forms.
    

    This is only relevant when pulling packages from known hosts like GitHub or GitLab, where the "shape and size" is fairly well understood.  The difference is in the current environment capabilities.  Ie, can it use ssh?  should it fail if it can't get the repo via git+https, or should it fall back to ssh?  should it use https first, or ssh first?  These are all system-specific, not dependency- or repo-specific.




    

    
          
    Having well-known hosts is admirable, as long as it is transparent, yet it smells like magic — an extra-bandwidth knowledge, which makes the system behave differently on unexpected factors. In my experience, it is a major source of support incidents and perceived bugs even when everything works fine.
    
  uhop, Tallyb, plaa, wesgarland, bryan-hoang, jansgescheit, reconbot, srl295, tstibbs, jaydenseric, and 164 more reacted with thumbs up emoji
  lightningspirit reacted with laugh emoji
  ralejandre, kellertobias, gen1us, cbartondock, mo-fc, and lightningspirit reacted with hooray emoji
  Mihailoff, kellertobias, gen1us, rfpedrosa, cbartondock, mo-fc, jacinda-shulman, lightningspirit, and rainabba reacted with heart emoji
      All reactions
Merge: f6c193f 5de8f9f
Author: Niklas <nscuro@protonmail.com>
Date:   Tue Oct 25 11:08:52 2022 +0200
    Merge pull request DependencyTrack#280 from DependencyTrack/dependabot/npm_and_yarn/xmldom/xmldom-0.8.3
    build(deps): bump @xmldom/xmldom from 0.8.2 to 0.8.3
commit f6c193f
Merge: 3f0ce6d c908972
Author: Niklas <nscuro@protonmail.com>
Date:   Tue Oct 25 11:08:36 2022 +0200
    Merge pull request DependencyTrack#305 from DependencyTrack/dependabot/docker/docker/nginxinc/nginx-unprivileged-94f0b80
    build(deps): bump nginxinc/nginx-unprivileged from `2d58b97` to `94f0b80` in /docker
commit c908972
Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Date:   Tue Oct 25 01:59:05 2022 +0000
    build(deps): bump nginxinc/nginx-unprivileged in /docker
    Bumps nginxinc/nginx-unprivileged from `2d58b97` to `94f0b80`.
    updated-dependencies:
    - dependency-name: nginxinc/nginx-unprivileged
      dependency-type: direct:production
      update-type: version-update:semver-patch
    Signed-off-by: dependabot[bot] <support@github.com>
commit 3f0ce6d
Merge: f38b9e6 1591b3f
Author: Niklas <nscuro@protonmail.com>
Date:   Mon Oct 24 23:30:04 2022 +0200
    Merge pull request DependencyTrack#298 from DependencyTrack/dependabot/github_actions/actions/upload-artifact-3.1.1
    build(deps): bump actions/upload-artifact from 3.1.0 to 3.1.1
commit f38b9e6
Merge: 47bcf76 9e56c9a
Author: Niklas <nscuro@protonmail.com>
Date:   Mon Oct 24 11:58:10 2022 +0200
    Merge pull request DependencyTrack#304 from nscuro/fix-gh-release
    Specify the target branch when creating a release via GitHub CLI
commit 9e56c9a
Author: nscuro <nscuro@protonmail.com>
Date:   Mon Oct 24 11:53:44 2022 +0200
    Specify the target branch when creating a release via GitHub CLI
    It uses `master` per default, which is not the intention when releasing from a release branch.
    Signed-off-by: nscuro <nscuro@protonmail.com>
commit 5de8f9f
Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Date:   Mon Oct 24 09:33:26 2022 +0000
    build(deps): bump @xmldom/xmldom from 0.8.2 to 0.8.3
    Bumps [@xmldom/xmldom](https://github.com/xmldom/xmldom) from 0.8.2 to 0.8.3.
    - [Release notes](https://github.com/xmldom/xmldom/releases)
    - [Changelog](https://github.com/xmldom/xmldom/blob/master/CHANGELOG.md)
    - [Commits](xmldom/xmldom@0.8.2...0.8.3)
    updated-dependencies:
    - dependency-name: "@xmldom/xmldom"
      dependency-type: indirect
    Signed-off-by: dependabot[bot] <support@github.com>
commit 47bcf76
Merge: 9b34ef9 f6763bc
Author: Niklas <nscuro@protonmail.com>
Date:   Mon Oct 24 11:32:14 2022 +0200
    Merge pull request DependencyTrack#301 from nscuro/replace-vue-showdown-master
    Remove dependency on vue-showdown
commit f6763bc
Author: nscuro <nscuro@protonmail.com>
Date:   Mon Oct 24 11:21:44 2022 +0200
    Fix NPM falsely using SSH URLs for GitHub repos
    Appears to only be necessary for the build with Node 14.
    npm/cli#2610
    Signed-off-by: nscuro <nscuro@protonmail.com>
commit e80627d
Author: nscuro <nscuro@protonmail.com>
Date:   Sat Oct 22 21:25:55 2022 +0200
    Remove dependency on vue-showdown
    Depend on Showdown directly instead, cutting out the middleman.
    Additionally:
    * Escape HTML outside of Markdown code blocks, in order to prevent unintended rendering of HTML elements (e.g. the `textarea` in CVE-2022-25869)
    * Always run Showdown output through DOMPurify
    Signed-off-by: nscuro <nscuro@protonmail.com>
commit 1591b3f
Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Date:   Mon Oct 24 01:54:42 2022 +0000
    build(deps): bump actions/upload-artifact from 3.1.0 to 3.1.1
    Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 3.1.0 to 3.1.1.
    - [Release notes](https://github.com/actions/upload-artifact/releases)
    - [Commits](actions/upload-artifact@v3.1.0...v3.1.1)
    updated-dependencies:
    - dependency-name: actions/upload-artifact
      dependency-type: direct:production
      update-type: version-update:semver-patch
    Signed-off-by: dependabot[bot] <support@github.com>
commit 9b34ef9
Merge: 9c6bd07 c4ed1f6
Author: Niklas <nscuro@protonmail.com>
Date:   Sat Oct 22 22:09:59 2022 +0200
    Merge pull request DependencyTrack#296 from nscuro/enable-releasing-from-release-branch
    Enable release creation from non-master branches
commit c4ed1f6
Author: nscuro <nscuro@protonmail.com>
Date:   Sat Oct 22 21:48:47 2022 +0200
    Update `RELEASING.md`
    Signed-off-by: nscuro <nscuro@protonmail.com>
commit 33bafea
Author: nscuro <nscuro@protonmail.com>
Date:   Sat Oct 22 21:37:14 2022 +0200
    Enable release creation from non-master branches
    This just makes the destination of version bump commits dependent on the branch the workflow is running on, instead of always pushing to `master`. This will allow us to run the workflow on release branches as well.
    Signed-off-by: nscuro <nscuro@protonmail.com>
commit 9c6bd07
Merge: 1ff579f 839f7de
Author: Niklas <nscuro@protonmail.com>
Date:   Fri Oct 21 13:30:32 2022 +0200
    Merge pull request DependencyTrack#295 from sahibamittal/snyk-integration-frontend
    Snyk integration frontend
commit 1ff579f
Merge: 8bcac46 031074c
Author: Niklas <nscuro@protonmail.com>
Date:   Fri Oct 21 12:02:22 2022 +0200
    Merge pull request DependencyTrack#294 from DependencyTrack/dependabot/github_actions/actions/download-artifact-3.0.1
    build(deps): bump actions/download-artifact from 3.0.0 to 3.0.1
commit 031074c
Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Date:   Fri Oct 21 01:57:23 2022 +0000
    build(deps): bump actions/download-artifact from 3.0.0 to 3.0.1
    Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 3.0.0 to 3.0.1.
    - [Release notes](https://github.com/actions/download-artifact/releases)
    - [Commits](actions/download-artifact@v3.0.0...v3.0.1)
    updated-dependencies:
    - dependency-name: actions/download-artifact
      dependency-type: direct:production
      update-type: version-update:semver-patch
    Signed-off-by: dependabot[bot] <support@github.com>
commit 8bcac46
Merge: 8362943 abf25ae
Author: Niklas <nscuro@protonmail.com>
Date:   Thu Oct 20 17:56:00 2022 +0200
    Merge pull request DependencyTrack#293 from nscuro/release-docs
    Add release documentation
commit 8362943
Merge: c400ae6 2c4e36c
Author: Niklas <nscuro@protonmail.com>
Date:   Thu Oct 20 17:48:08 2022 +0200
    Merge pull request DependencyTrack#292 from DependencyTrack/dependabot/docker/docker/nginxinc/nginx-unprivileged-1.23.2-alpine
    build(deps): bump nginxinc/nginx-unprivileged from 1.23.1-alpine to 1.23.2-alpine in /docker
commit c400ae6
Merge: c5c5ab3 ae3c963
Author: Niklas <nscuro@protonmail.com>
Date:   Thu Oct 20 17:47:52 2022 +0200
    Merge pull request DependencyTrack#291 from DependencyTrack/dependabot/github_actions/docker/setup-buildx-action-2.2.1
    build(deps): bump docker/setup-buildx-action from 2.2.0 to 2.2.1
commit abf25ae
Author: nscuro <nscuro@protonmail.com>
Date:   Thu Oct 20 17:43:53 2022 +0200
    Add release documentation
    Signed-off-by: nscuro <nscuro@protonmail.com>
commit 2c4e36c
Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Date:   Thu Oct 20 01:51:11 2022 +0000
    build(deps): bump nginxinc/nginx-unprivileged in /docker
    Bumps nginxinc/nginx-unprivileged from 1.23.1-alpine to 1.23.2-alpine.
    updated-dependencies:
    - dependency-name: nginxinc/nginx-unprivileged
      dependency-type: direct:production
      update-type: version-update:semver-patch
    Signed-off-by: dependabot[bot] <support@github.com>
commit ae3c963
Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Date:   Wed Oct 19 01:45:01 2022 +0000
    build(deps): bump docker/setup-buildx-action from 2.2.0 to 2.2.1
    Bumps [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) from 2.2.0 to 2.2.1.
    - [Release notes](https://github.com/docker/setup-buildx-action/releases)
    - [Commits](docker/setup-buildx-action@v2.2.0...v2.2.1)
    updated-dependencies:
    - dependency-name: docker/setup-buildx-action
      dependency-type: direct:production
      update-type: version-update:semver-patch
    Signed-off-by: dependabot[bot] <support@github.com>
commit c5c5ab3
Merge: 0bf649a 622f275
Author: Niklas <nscuro@protonmail.com>
Date:   Tue Oct 18 18:57:26 2022 +0200
    Merge pull request DependencyTrack#290 from nscuro/revert-272
commit 622f275
Author: nscuro <nscuro@protonmail.com>
Date:   Tue Oct 18 18:12:27 2022 +0200
    Revert "Merge pull request DependencyTrack#272 from rbt-mm/master-show-hierarchical-view-in-project-list"
    This reverts commit 58b8940, reversing
    changes made to 3a64bbc.
    Signed-off-by: nscuro <nscuro@protonmail.com>
commit 0bf649a
Merge: 58b8940 b03b122
Author: Niklas <nscuro@protonmail.com>
Date:   Tue Oct 18 17:51:34 2022 +0200
    Merge pull request DependencyTrack#274 from rbt-mm/master-limit-alert-rules-to-project-including-all-existing-or-future-versions
    Include a projects children in an alert rules limitations
commit 58b8940
Merge: 3a64bbc abfe53c
Author: Niklas <nscuro@protonmail.com>
Date:   Tue Oct 18 17:46:59 2022 +0200
    Merge pull request DependencyTrack#272 from rbt-mm/master-show-hierarchical-view-in-project-list
    Show hierarchical view in project list
commit abfe53c
Author: rbt-mm <113189967+rbt-mm@users.noreply.github.com>
Date:   Tue Oct 18 17:05:21 2022 +0200
    Hide detail view button when no active child
    Signed-off-by: RBickert <rbt@mm-software.com>
    Co-authored-by: Niklas <nscuro@protonmail.com>
    Signed-off-by: RBickert <rbt@mm-software.com>
commit dbb34d3
Author: RBickert <rbt@mm-software.com>
Date:   Tue Oct 4 17:56:55 2022 +0200
    Change prototype method in project list
    Do not access Object.prototype method 'hasOwnProperty' from target
    object.
    Only show project name in create project modal, if a project does not
    have a version
    Signed-off-by: RBickert <rbt@mm-software.com>
commit a79d535
Author: RBickert <rbt@mm-software.com>
Date:   Tue Oct 4 17:03:10 2022 +0200
    Revert "Update ci-build.yaml"
    This reverts commit aeccadc.
    Signed-off-by: RBickert <rbt@mm-software.com>
commit d7b8d69
Author: RBickert <rbt@mm-software.com>
Date:   Fri Sep 30 16:27:18 2022 +0200
    Filter detail view parents in backend
    Available parents in a project detail view are now filtered in the
    backend instead of the UI
    Signed-off-by: RBickert <rbt@mm-software.com>
commit 87a9d8c
Author: RBickert <rbt@mm-software.com>
Date:   Thu Sep 29 16:37:23 2022 +0200
    Fix switching parent to inactive
    A parent project cannot be set to inactive if any of his children are
    set to active
    Signed-off-by: RBickert <rbt@mm-software.com>
commit 11c7eab
Author: RBickert <rbt@mm-software.com>
Date:   Fri Sep 23 16:28:37 2022 +0200
    Add hierarchical view in project list
    Added CSwitch in project list to switch between current flat view
    (default) and a new hierarchical view (shows root projects and their
    children in the detail view of a row).
    Project detail view only shows viable projects as selectable parent.
    Hierarchical project list shows inactive projects for children and
    children are sortable.
    Signed-off-by: RBickert <rbt@mm-software.com>
commit ee96685
Author: RBickert <rbt@mm-software.com>
Date:   Tue Sep 20 17:03:51 2022 +0200
    Add persistent selection of parent to detail view
    Send selected parent in project detail view via API call to backend to
    create a persistent parent-child-relationship.
    Signed-off-by: RBickert <rbt@mm-software.com>
commit b05a11c
Author: RBickert <rbt@mm-software.com>
Date:   Mon Sep 19 16:53:00 2022 +0200
    Add parent in project creation and detail view
    Display list of every project in `Create Project` and `View
    Project` to select a parent project for the new or current project.
    Send selected parent in project creation via API call to backend to
    create a persistent parent-child-relationship.
    Signed-off-by: RBickert <rbt@mm-software.com>
commit 053f6fa
Author: rbt-mm <113189967+rbt-mm@users.noreply.github.com>
Date:   Wed Sep 28 13:24:38 2022 +0200
    Update ci-build.yaml
    Workflow now starts on every pull request, if the branch name contains 'master' in it.
    Signed-off-by: RBickert <rbt@mm-software.com>
commit b03b122
Author: RBickert <rbt@mm-software.com>
Date:   Tue Oct 18 13:11:23 2022 +0200
    Make inclusion of children optional
    Added a switch in the alerts view which optionally includes every active
    child of the subscribed projects in the notification rule.
    Signed-off-by: RBickert <rbt@mm-software.com>
commit 298c5be
Merge: 54e7c51 3a64bbc
Author: rbt-mm <113189967+rbt-mm@users.noreply.github.com>
Date:   Tue Oct 18 13:01:18 2022 +0200
    Merge branch 'DependencyTrack:master' into master-limit-alert-rules-to-project-including-all-existing-or-future-versions
commit 3a64bbc
Merge: 8a1239c 9d78a3b
Author: Niklas <nscuro@protonmail.com>
Date:   Tue Oct 18 10:06:35 2022 +0200
    Merge pull request DependencyTrack#287 from DependencyTrack/dependabot/docker/docker/nginxinc/nginx-unprivileged-5af0906
    build(deps): bump nginxinc/nginx-unprivileged from `31ac9ab` to `5af0906` in /docker
commit 8a1239c
Merge: 21cd1f0 0610ba0
Author: Niklas <nscuro@protonmail.com>
Date:   Tue Oct 18 10:06:26 2022 +0200
    Merge pull request DependencyTrack#288 from DependencyTrack/dependabot/github_actions/docker/setup-buildx-action-2.2.0
    build(deps): bump docker/setup-buildx-action from 2.1.0 to 2.2.0
commit 0610ba0
Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Date:   Tue Oct 18 01:33:58 2022 +0000
    build(deps): bump docker/setup-buildx-action from 2.1.0 to 2.2.0
    Bumps [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) from 2.1.0 to 2.2.0.
    - [Release notes](https://github.com/docker/setup-buildx-action/releases)
    - [Commits](docker/setup-buildx-action@v2.1.0...v2.2.0)
    updated-dependencies:
    - dependency-name: docker/setup-buildx-action
      dependency-type: direct:production
      update-type: version-update:semver-minor
    Signed-off-by: dependabot[bot] <support@github.com>
commit 9d78a3b
Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Date:   Tue Oct 18 01:33:57 2022 +0000
    build(deps): bump nginxinc/nginx-unprivileged in /docker
    Bumps nginxinc/nginx-unprivileged from `31ac9ab` to `5af0906`.
    updated-dependencies:
    - dependency-name: nginxinc/nginx-unprivileged
      dependency-type: direct:production
      update-type: version-update:semver-patch
    Signed-off-by: dependabot[bot] <support@github.com>
commit 54e7c51
Merge: 1eaefe5 c80f0ea
Author: rbt-mm <113189967+rbt-mm@users.noreply.github.com>
Date:   Wed Oct 5 14:09:32 2022 +0200
    Merge pull request #3 from rbt-mm/rbt-limit-alert-rules-to-project-including-all-existing-or-future-versions
    Limit alert rules to project including all existing or future versions
commit c80f0ea
Author: RBickert <rbt@mm-software.com>
Date:   Wed Oct 5 10:53:17 2022 +0200
    Add new info in alerts view
    Change "Limit to projects" to "Limit to projects (including all of their
    active children)" to indicate that every child of a subscribed project
    will also be included in the notification rule.
    Signed-off-by: RBickert <rbt@mm-software.com>
    
  domino14, sidpremkumar, Git-I985, macrouch, tracetechnical, and twinklecube reacted with thumbs up emoji
  tracetechnical reacted with hooray emoji
  tracetechnical reacted with heart emoji
      All reactions




    

          
    Running NPM 6.14.x, this is only an issue with lockfile v2. Reverting back to a v1 lockfile fixes it.
    

    Compare the CI check before and after the last commit here: nextstrain/nextstrain.org@1b6d471...db923e2
    

    I just had success by changing from git+https://github.com/ to git+https://git@github.com/ —it then resolved to HTTPS in my lock file.
    

    this seemed insane enough to try, and i did, and this worked. Thank you!
    

    So basically, npm install git+https://git@github.com/user/repo is what i did
    
"version": "git+ssh://github.com/paulswartz/turbolinks.git#82b188ec4cf2177e2ce9b18698206476178befa1",
to (npm 6):
"version": "git+https://github.com/paulswartz/turbolinks.git#82b188ec4cf2177e2ce9b18698206476178befa1",
It turns out there's an [NPM bug](npm/cli#2610) in npm 7 that records git repo dependencies with `ssh://` instead of `https://`, which was causing the `npm ci` step in our Docker container to fail because of not having set up SSH keys.
We'll probably have to reconsider our setup eventually, but for now let's just use the `https://` version.
    "version": "git+ssh://github.com/paulswartz/turbolinks.git#82b188ec4cf2177e2ce9b18698206476178befa1", to (npm 6): "version": "git+ https://github.com/paulswartz/turbolinks.git#82b188ec4cf2177e2ce9b18698206476178befa1 ", It turns out there's an [NPM bug]( npm/cli#2610 ) in npm 7 that records git repo dependencies with `ssh://` instead of `https://`, which was causing the `npm ci` step in our Docker container to fail because of not having set up SSH keys. We'll probably have to reconsider our setup eventually, but for now let's just use the `https://` version. 
    * chore(npm): downgrade to lockfileVersion 1
* chore(Dockerfile): don't upgrade npm version
* docs: Add a note about npm versioning
* chore: regenerate `package-lock.json` using correct npm version
The real change here is the change from the npm-v7-generated
"version": "git+ssh://github.com/paulswartz/turbolinks.git#82b188ec4cf2177e2ce9b18698206476178befa1",
to (npm 6):
"version": "git+https://github.com/paulswartz/turbolinks.git#82b188ec4cf2177e2ce9b18698206476178befa1",
It turns out there's an [NPM bug](npm/cli#2610) in npm 7 that records git repo dependencies with `ssh://` instead of `https://`, which was causing the `npm ci` step in our Docker container to fail because of not having set up SSH keys.
We'll probably have to reconsider our setup eventually, but for now let's just use the `https://` version.
* chore: resolve conflict with master branch
* chore: add and enforce react type resolution
there's a version conflict in dependencies using the `@types/react` package - using the intended one makes type checks pass.

    @msimerson I'm completely baffled by this too. How is this still an issue? The only thing that is working for me is using the full URLs starting with git+https . Even the mentioned git config commands don't work; the resulting package-lock.json after running npm install still contains the git+ssh URLs. (I might have misunderstood the solution and maybe it needs to run on every device before calling npm ci , but that's just not feasible. I simply want to have a working package-lock.json file...)

    Does has anybody provided a PR or a fork fixing this? It should not be so much difficult to do...

    There is the exact same issue on yarn 1.X, and it's solved the same way, by adding the "git@" in the URL.

    The git@github.com solution doesn't work for private repositories, because it will actually attempt to authenticate with the "git" user.

    We would actually need to put in our own dev account username in there to make this approach work, which is 100% not feasible.

    Tested on the latest version of npm -- 9.8.1 -- and haven't upgraded past v6 because of this nonsense.

    EDIT: because a fix for this doesn't look like this is coming any time soon and the last vresion where this works is out of support, have added this bash workaround and used where needed: 

    function configureGitForceHttps {
    git config url."https://".insteadOf ssh://
     
    推荐文章
    今天看啥   ·   Py中国   ·   codingpro   ·   小百科   ·   link之家   ·   卧龙AI搜索
    删除内容请联系邮箱 2879853325@qq.com
    小百科 - 百科知识指南
    © 2024 ~ 沪ICP备11025650号