[BUG] GitHub org/name accesses fail

[ilg-ul]

Direct accesses to GitHub by short 'org/name' fail.

$ pacote -h
Pacote - The JavaScript Package Handler, v10.1.3
...
$ pacote manifest npm/cli
Error: failed '/usr/bin/git ls-remote git+ssh://git@github.com/npm/cli.git'
    at ChildProcess.<anonymous> (/Users/ilg/.nvm/versions/node/v12.13.0/lib/node_modules/pacote/lib/util/spawn.js:21:43)
    at ChildProcess.emit (events.js:210:5)
    at maybeClose (internal/child_process.js:1021:16)
    at Socket.<anonymous> (internal/child_process.js:430:11)
    at Socket.emit (events.js:210:5)
    at Pipe.<anonymous> (net.js:658:12) {
  cmd: '/usr/bin/git',
  args: [ 'ls-remote', 'git+ssh://git@github.com/npm/cli.git' ],
  code: 128,
  signal: null,
  stdout: '',
  stderr: 'git@github.com: Permission denied (publickey).\r\n' +
    'fatal: Could not read from remote repository.\n' +
    '\n' +
    'Please make sure you have the correct access rights\n' +
    'and the repository exists.\n'
}
$ pacote manifest github:npm/cli
Error: failed '/usr/bin/git ls-remote git+ssh://git@github.com/npm/cli.git'
    at ChildProcess.<anonymous> (/Users/ilg/.nvm/versions/node/v12.13.0/lib/node_modules/pacote/lib/util/spawn.js:21:43)
    at ChildProcess.emit (events.js:210:5)
    at maybeClose (internal/child_process.js:1021:16)
    at Socket.<anonymous> (internal/child_process.js:430:11)
    at Socket.emit (events.js:210:5)
    at Pipe.<anonymous> (net.js:658:12) {
  cmd: '/usr/bin/git',
  args: [ 'ls-remote', 'git+ssh://git@github.com/npm/cli.git' ],
  code: 128,
  signal: null,
  stdout: '',
  stderr: 'git@github.com: Permission denied (publickey).\r\n' +
    'fatal: Could not read from remote repository.\n' +
    '\n' +
    'Please make sure you have the correct access rights\n' +
    'and the repository exists.\n'
}
$ pacote resolve npm/cli
Error: failed '/usr/bin/git ls-remote git+ssh://git@github.com/npm/cli.git'
    at ChildProcess.<anonymous> (/Users/ilg/.nvm/versions/node/v12.13.0/lib/node_modules/pacote/lib/util/spawn.js:21:43)
    at ChildProcess.emit (events.js:210:5)
    at maybeClose (internal/child_process.js:1021:16)
    at Socket.<anonymous> (internal/child_process.js:430:11)
    at Socket.emit (events.js:210:5)
    at Pipe.<anonymous> (net.js:658:12) {
  cmd: '/usr/bin/git',
  args: [ 'ls-remote', 'git+ssh://git@github.com/npm/cli.git' ],
  code: 128,
  signal: null,
  stdout: '',
  stderr: 'git@github.com: Permission denied (publickey).\r\n' +
    'fatal: Could not read from remote repository.\n' +
    '\n' +
    'Please make sure you have the correct access rights\n' +
    'and the repository exists.\n'
}
$ pacote extract npm/cli ccc
Error: failed '/usr/bin/git ls-remote git+ssh://git@github.com/npm/cli.git'
    at ChildProcess.<anonymous> (/Users/ilg/.nvm/versions/node/v12.13.0/lib/node_modules/pacote/lib/util/spawn.js:21:43)
    at ChildProcess.emit (events.js:210:5)
    at maybeClose (internal/child_process.js:1021:16)
    at Socket.<anonymous> (internal/child_process.js:430:11)
    at Socket.emit (events.js:210:5)
    at Pipe.<anonymous> (net.js:658:12) {
  cmd: '/usr/bin/git',
  args: [ 'ls-remote', 'git+ssh://git@github.com/npm/cli.git' ],
  code: 128,
  signal: null,
  stdout: '',
  stderr: 'git@github.com: Permission denied (publickey).\r\n' +
    'fatal: Could not read from remote repository.\n' +
    '\n' +
    'Please make sure you have the correct access rights\n' +
    'and the repository exists.\n'
}

Access to the same repo with full URL seems ok for getting the manifest:

$ pacote manifest https://github.com/npm/cli
{
  version: '6.13.1',
  name: 'npm',
  description: 'a package manager for JavaScript',
  ...
  readmeFilename: 'README.md',
  gitHead: 'b829d62c98506325d2afb2d85d191a8ff1c49157',
  _id: 'npm@6.13.1',
  _integrity: null,
  _resolved: 'git+ssh://git@github.com/npm/cli.git#b829d62c98506325d2afb2d85d191a8ff1c49157',
  _from: 'github:npm/cli'
}

... but fails with the same error when trying to extract:

$ pacote extract https://github.com/npm/cli ccc
Error: failed '/usr/bin/git ls-remote git+ssh://git@github.com/npm/cli.git'
    at ChildProcess.<anonymous> (/Users/ilg/.nvm/versions/node/v12.13.0/lib/node_modules/pacote/lib/util/spawn.js:21:43)
    at ChildProcess.emit (events.js:210:5)
    at maybeClose (internal/child_process.js:1021:16)
    at Socket.<anonymous> (internal/child_process.js:430:11)
    at Socket.emit (events.js:210:5)
    at Pipe.<anonymous> (net.js:658:12) {
  cmd: '/usr/bin/git',
  args: [ 'ls-remote', 'git+ssh://git@github.com/npm/cli.git' ],
  code: 128,
  signal: null,
  stdout: '',
  stderr: 'git@github.com: Permission denied (publickey).\r\n' +
    'fatal: Could not read from remote repository.\n' +
    '\n' +
    'Please make sure you have the correct access rights\n' +
    'and the repository exists.\n'
}

I wouldn't be surprised to find out that GitHub changed something in their configurations, but anyway it would be good to clarify the issue.

Thank you,

Liviu

[ilg-ul]

To rule out a bad local configuration, I also tried on a separate Ubuntu VM and the result is the same, but git asked for credentials:

$ pacote resolve npm/cli
The authenticity of host 'github.com (140.82.118.4)' can't be established.
RSA key fingerprint is SHA256:nThbg6kXUpJWGl7E1IGOCspRomTxdCARLviKw6E5SY8.
Are you sure you want to continue connecting (yes/no)? yes
{ Error: failed '/usr/bin/git ls-remote git+ssh://git@github.com/npm/cli.git'
...

[ilg-ul]

I'm very curious why npm can install packages from GitHub. Is it because it is using an older pacote (^9.5.9)?

[ilg-ul]

I confirm that after reverting to 9.5.9 I can access GitHub repos using org/name, as expected.

So it must be an issue with 10.x. The next question would be why the tests did not catch it...

[isaacs]

The issue is that it's preferring git+ssh over git+https for all hosted repos.

Fix coming shortly :)

[isaacs]

I noticed this when my tests in npm/arborist were buzzing my phone for a 2FA authorization to use my SSH keys :)

SSH is better for private repos, since it's more straightforward for doing headless authentication with a key and doesn't require putting a basic auth in the url, but obviously not as good for public repos, which is the majority use case. Pacote 9 tries https, then falls back to ssh, which is what v10.1.6 does now as well.

[ilg-ul]

Since I'm not familiar with the implementation details, can you confirm that the behaviour now is fully similar to that of 9.x?

I'm a bit concerned about 'Resolved url is still reported as the git+ssh url, for consistency.' Was it the same in 9.x?

[isaacs]

The resolved url always being saved as ssh is new. (In v9 it was less deterministic, varying if the original url was ssh or https.) But the fetch behavior is the same as v9 now, yes.