unpublish specific version uses relative url of tarball

[shayke]

This is a problem when using private repo host with a subpath.
Scenario (my registry is set to http://localhost/api/npm/npm-local):
npm unpublish --force npm WARN using --force I sure hope you know what you are doing. npm http GET http://localhost/api/npm/npm-local/pkg?write=true npm http 200 http://localhost/api/npm/npm-local/pkg?write=true npm http PUT http://localhost/api/npm/npm-local/pkg/-rev/1-0 npm http 200 http://localhost/api/npm/npm-local/pkg/-rev/1-0 npm http DELETE http://localhost/api/npm/npm-local/api/npm/npm-local/pkg/-/pkg-0.0.3.tgz/-rev/1-0 npm http 405 http://localhost/api/npm/npm-local/api/npm/npm-local/pkg/-/pkg-0.0.3.tgz/-rev/1-0

Notice that my tarballs are located at:
http://localhost/api/npm/npm-local/pkg/-/pkg-0.0.1.tgz
http://localhost/api/npm/npm-local/pkg/-/pkg-0.0.2.tgz
http://localhost/api/npm/npm-local/pkg/-/pkg-0.0.3.tgz

Looks like the code at unpublish.js is taking the subpath of the tarballs and adding it to the initial request, is there a reason for that logic?

[isaacs]

This is a bug. It should be adding just the portion of the tarball path after the registry path.

[azweb76]

Is there a fix for this? This impacts the ability to unpublish from the latest version of Artifactory.

[tsneed290]

Is there a plan to address this in the future? I'm in the same boat as @azweb76.

Disregard, I was attempting to unpublish via the Virtual Repo (that points to https://registry.npmjs.org/ and our local registry). Once I pointed directly to the Local Repo during the npm unpublish operation, it unpublished successfully.

[mhofman]

@tsneed290 how did you solve the issue with artifactory? I'm trying to unpublish from the local repository but it's still appending that revision suffix.

[alindsay55661]

Same here, artifactory is appending revision suffix. Would be great to know the workaround.

[tsneed290]

@mhofman I'm sorry I missed this message 8 months ago.

It's been a while, but let me look at my local repo tomorrow and I'll come back with comments.

[tsneed290]

So, I have an Artifactory instance and have configured it using the instructions at https://www.jfrog.com/confluence/display/RTF/Npm+Registry#NpmRegistry-Configuration.

Specifically, I have a local NPM repo (npm-local) which holds the private modules and a remote repo pointing to NPM's registry (npm-remote). I then created a Virtual repo (npm-virtual) that contains both npm-local and npm-remote.

This virtual repo (npm-virtual) is what devs define as their "registry" setting in their own .npmrc file. This allows them to access both private, internal packages from npm-local as well as public modules located in NPM's public registry, npm-remote.

Here's an example of that "registry" property in .npmrc for normal development:
registry=http://artifactory.company.com/artifactory/api/npm/npm-virtual

Now, as for the original problem, the only way I can unpublish a private module is to update my .npmrc's "registry" setting to point directly to npm-local (and NOT the Virtual Repo, npm-virtual) and then run `npm unpublish [email protected]`.

Here's an example of the updated "registry" property in .npmrc for unpublishing:
registry=http://artifactory.company.com/artifactory/api/npm/npm-local

Now I realize this isn't a great workaround, but I noticed that even though my package.json had the publishConfig correctly pointing to the URL of npm-local, the npm unpublish command did not respect that property. The registry property defined in my .npmrc file (pointing to npm-virtual) seemed to take precedence. I'm currently using NPM v3.10.9 at the time of this writing.

I found an old Github issue regarding npm unpublish not respecting publishConfig. It's marked as closed, but the problem seems to still persist to me.

Edit: After some finer reading of the NPM issue #3032, it looks like I should be using an .npmrc file local to my project. I'll try that tomorrow and report back.

[lenaing]

Hi,
There is also this subject, maybe related : https://github.com/npm/libnpmpublish/issues/5
Kind regards,

[llienard]

Hi,
Any updates ?
Regards

[pjivers-bom]

Has there been any movement on this? Still having this issue with Artifactory v6.5.2