Installing of packages from a private gitlab registry fails with 404

[luiskugel]

Verify latest release

• I verified that the issue exists in the latest pnpm release

pnpm version

8.15.5

Which area(s) of pnpm are affected? (leave empty if unsure)

Dependencies resolver

Link to the code that reproduces this issue or a replay of the bug

No response

Reproduction steps

This is my .npmrc file:

//registry.npmjs.org/:_authToken=npm_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
//git.idot.digital/api/v4/packages/npm/:_authToken=xxxxx-xxxxxxxxxxxxxxxxxxxxxx
//git.idot.digital/api/v4/packages/npm/:always-auth=true
@idot-digital:registry=https://git.idot.digital/api/v4/packages/npm/
@digital-sun-solutions:registry=https://git.idot.digital/api/v4/packages/npm/
always-auth=true
registry=https://registry.npmjs.com/

i just ran:

pnpm install @idot-digital/function-generator

Describe the Bug

When i try to install a package from my private gitlab registry. i get a 404 error:

ERR_PNPM_FETCH_404  GET https://git.idot.digital/api/v4/projects/57/packages/npm/@idot-digital/function-generator/-/@idot-digital/function-generator-2.23.3.tgz: Not Found - 404

But it succeeds with npm

Expected Behavior

To download the package just like npm.

Which Node.js version are you using?

20.11.1

Which operating systems have you used?

• macOS
• Windows
• Linux

If your OS is a Linux based, which one it is? (Include the version if relevant)

No response

[Jisagi]

I had the exact issue but was able to solve it (see last sentence #5616 (comment)).

TL;DR add the project level auth to the .npmrc so pnpm can add the auth to the request header when getting the tgz.

Before

//git.idot.digital/api/v4/packages/npm/:_authToken=xxxxx-xxxxxxxxxxxxxxxxxxxxxx
@idot-digital:registry=https://git.idot.digital/api/v4/packages/npm/

After

//git.idot.digital/api/v4/packages/npm/:_authToken=xxxxx-xxxxxxxxxxxxxxxxxxxxxx
//git.idot.digital/api/v4/projects/57/packages/npm/:_authToken=xxxxx-xxxxxxxxxxxxxxxxxxxxxx
@idot-digital:registry=https://git.idot.digital/api/v4/packages/npm/

By doing this, pnpm finally installs the package (this does not break npm install btw). Seems like pnpm does not check the instance level auth and adds it to the project specific download. npm can do it, but pnpm cannot.

Tested with:

• windows 10
• node v22.1.0
• npm v10.2.5
• pnpm v9.0.6

[manuschillerdev]

we see the same issue with pnpm 9.9.0. removing the lockfile and installing on ci without a lockfile works fine, though

[42tg]

Maybe try this

//registry.npmjs.org/:_authToken=npm_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
//git.idot.digital/api/v4/packages/npm/:_authToken=xxxxx-xxxxxxxxxxxxxxxxxxxxxx
//git.idot.digital/api/v4/packages/npm/:always-auth=true
+ //git.idot.digital/api/v4/projects/:_authToken=xxxxx-xxxxxxxxxxxxxxxxxxxxxx
@idot-digital:registry=https://git.idot.digital/api/v4/packages/npm/
@digital-sun-solutions:registry=https://git.idot.digital/api/v4/packages/npm/
always-auth=true
registry=https://registry.npmjs.com/

At least this fixed the issue for us

[luiskugel]

@42tg Yea, thanks. When i add this line it works.

But I think this should not be necessary. Maybe I am wrong on this, but with npm there is no issue and I also never saw any documentation on this. And as it works without this line with "normal" npm I think this is nothing where gitlab has to change something. Or am I missing something here?

[szymonworld]

I have the same issue, locally works fine, but gitlab CI/CD gets error. My npmrc:

- echo "@e1111:registry=https://gitlab.com/api/v4/packages/npm/" >> .npmrc
- echo "//gitlab.com/api/v4/packages/npm/:_authToken=${CI_JOB_TOKEN}" >> .npmrc
- echo "//gitlab.com/api/v4/packages/:_authToken=${CI_JOB_TOKEN}" >> .npmrc
- echo "//gitlab.com/api/v4/:_authToken=${CI_JOB_TOKEN}" >> .npmrc
- echo "//gitlab.com/api/v4/projects/222222/packages/npm/:_authToken=${CI_JOB_TOKEN}" >> .npmrc
- echo "//gitlab.com/api/v4/projects/1111222/packages/npm/:_authToken=${CI_JOB_TOKEN}" >> .npmrc
- echo "always-auth=true" >> .npmrc
- pnpm i

I have read a lot of threads on github but none of them help...
I'm using pnpm 8.10.5

[luiskugel]

@szymonworld I had the same issue. But this is another problem and from my understanding, not a problem of pnpm but one of gitlab. The CI_JOB_TOKEN just has no rights to read other packages.

I created a ci account and created a token from it and then added the token as variable. It is not pretty, but it works.

[lobre]

The proposed "solutions" are merely workarounds. This issue isn't specific to GitLab—it affects all registries that forward requests for packages outside their scope.

npm's fetcher module explicitly handles this case, whereas pnpm does not.

To address the core problem, pnpm maintainers need to decide whether to forward authentication from the logged-in registry, even when the package tarball is hosted elsewhere.

For reference, here's how npm implements it:

https://github.com/npm/npm-registry-fetch/blob/818b6f7bd235e939871e97963dd59cf8f06e80d1/lib/auth.js#L106

I'm new to pnpm and unsure of its guiding principles, but if aligning with npm's behavior is a goal, mirroring this approach could be beneficial.