Cannot get aube to work behind company firewall

[manuel-mauky]

I'm struggeling to get aube to work. I've installed it via mise and when I run aube doctor it shows no issues. However, when I run aube install in an existing project, it cannot download any dependencies. I get many warnings like this:

 WARN aube_registry::client::packument: retrying HTTP request after transport error attempt=2 max_attempts=3 backoff_ms=60000 error=error sending request for url (https://registry.npmjs.org/@types%2Fnode) label="packument @types/node" code="WARN_AUBE_HTTP_RETRY_TRANSPORT"

and then at the end this error:

ERR_AUBE_REGISTRY_ERROR

  × failed to resolve dependencies
  ╰─▶ registry error for ramda: HTTP error: error sending request for url (https://registry.npmjs.org/ramda)
  help: package: ramda
        packument fetch failed — verify the registry URL in .npmrc, check auth (`npm login` / `NPM_TOKEN`), and confirm network connectivity

Most likely the reason is that I'm behind a company firewall that acts as a man-in-the-middle. For that reason, for NPM I had to configure cafile pointing to the root certificate in my .npmrc. For NPM it does work perfectly fine and I understood the aube docs so that it should also use this setting. In my .npmrc I have these configs:

registry=https://registry.npmjs.org/
cafile=<path-to-root-ca-file>.pem
strict-ssl=true

Running aube config list also shows these settings.

What could be the issue? How can I debug this?

[jdx]

Thanks for the report. cafile is supposed to work: aube parses the top-level setting and adds the PEM certificates to its registry clients. However, aube doctor currently does not validate the CA file or make a registry request, and the displayed transport error hides the underlying rustls cause.

Could you first confirm that cafile is an absolute path, then try:

CA="$(npm config get cafile)"
test -r "$CA" && echo readable
openssl x509 -in "$CA" -noout -subject -issuer
curl --cacert "$CA" https://registry.npmjs.org/ramda

NODE_EXTRA_CA_CERTS="$CA" npm_config_fetch_retries=0 aube view ramda
npm_config_strict_ssl=false npm_config_fetch_retries=0 aube view ramda

The last command is diagnostic only; please do not persist strict-ssl=false.

• If strict-ssl=false works, this is certificate validation.
• If NODE_EXTRA_CA_CERTS works but .npmrc cafile does not, that strongly suggests an aube cafile propagation/path bug.
• If neither works, proxy or network routing is more likely.

I am not on your company network, so I cannot reproduce the MITM setup directly. If you can isolate the failure, a PR would be very welcome. The relevant code is in crates/aube-registry/src/client/http.rs and crates/aube-registry/src/config/. Ideally the PR would include an end-to-end TLS test using a private test CA for the main registry client; the existing handshake coverage currently exercises NODE_EXTRA_CA_CERTS, while the top-level cafile test only checks parsing.

It would also be useful to improve the production error so it prints the full reqwest/rustls source chain (for example UnknownIssuer) and to make aube doctor validate configured CA files.

AI-assisted — Tool: Codex; model: OpenAI/GPT-5; version: unavailable.

[manuel-mauky]

Thanks for the hints. cafile is an absolute path for me.
I've tried the commands:

test -r "$CA" && echo readable prints readable.
The openssl command prints the expected subject and issuer of my companies firewall provider.

curl does work fine.

However, the other two commands do not work. Both print the same error:

❯ NODE_EXTRA_CA_CERTS="$CA" npm_config_fetch_retries=0 aube view ramda
  × failed to fetch ramda: HTTP error: error sending request for url (https://registry.npmjs.org/ramda)

❯ npm_config_strict_ssl=false npm_config_fetch_retries=0 aube view ramda
  × failed to fetch ramda: HTTP error: error sending request for url (https://registry.npmjs.org/ramda)

In addition to NPM I now also tried PNPM and Yarn and all of them worked perfectly fine. Only with aube I'm having this issue.

I'm not experienced with rust so I won't be able to provide a PR.