{"action":"closed","issue":{"url":"https://api.github.com/repos/npm/npm/issues/13341","repository_url":"https://api.github.com/repos/npm/npm","labels_url":"https://api.github.com/repos/npm/npm/issues/13341/labels{/name}","comments_url":"https://api.github.com/repos/npm/npm/issues/13341/comments","events_url":"https://api.github.com/repos/npm/npm/issues/13341/events","html_url":"https://github.com/npm/npm/issues/13341","id":164924214,"number":13341,"title":"Remote Github tarballs 404","user":{"login":"schmod","id":1102667,"avatar_url":"https://avatars0.githubusercontent.com/u/1102667?v=3","gravatar_id":"","url":"https://api.github.com/users/schmod","html_url":"https://github.com/schmod","followers_url":"https://api.github.com/users/schmod/followers","following_url":"https://api.github.com/users/schmod/following{/other_user}","gists_url":"https://api.github.com/users/schmod/gists{/gist_id}","starred_url":"https://api.github.com/users/schmod/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/schmod/subscriptions","organizations_url":"https://api.github.com/users/schmod/orgs","repos_url":"https://api.github.com/users/schmod/repos","events_url":"https://api.github.com/users/schmod/events{/privacy}","received_events_url":"https://api.github.com/users/schmod/received_events","type":"User","site_admin":false},"labels":[{"id":628325029,"url":"https://api.github.com/repos/npm/npm/labels/bot-closed","name":"bot-closed","color":"fef2c0","default":false}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2016-07-11T20:15:57Z","updated_at":"2017-06-18T11:19:50Z","closed_at":"2017-06-18T11:19:50Z","body":"#### I'm opening this issue because:\n- [x] npm is doing something I don't understand.\n#### What's going wrong?\n\nIf I have a package that lists an external tarball in its `package.json` (like [JSDoc 3.3.2](https://github.com/jsdoc3/jsdoc/blob/3.3.2/package.json)'s dependency on esprima), npm indicates that the remote URL returned a 404.\n\n```\n5619 http fetch 404 https://github.com/ariya/esprima/tarball/49a2eccb243f29bd653b11e9419241a9d726af7c\n5620 error fetch failed https://github.com/ariya/esprima/tarball/49a2eccb243f29bd653b11e9419241a9d726af7c\n```\n\nThese URLs appear to be perfectly valid if I try to access them by other means, so this is obviously _very confusing_.  \n\nTry for yourself: https://github.com/ariya/esprima/tarball/49a2eccb243f29bd653b11e9419241a9d726af7c\n#### Specifics of my setup:\n- My project depends on [angular-jsdoc](https://www.npmjs.com/package/angular-jsdoc), which depends on [jsdoc 3.3.2](https://github.com/jsdoc3/jsdoc/tree/3.3.2), which in turn references two static tarballs in its [`package.json`](https://github.com/jsdoc3/jsdoc/blob/3.3.2/package.json): \n  \n  ```\n  \"dependencies\": {\n    \"esprima\": \"https://github.com/ariya/esprima/tarball/49a2eccb243f29bd653b11e9419241a9d726af7c\",\n    \"taffydb\": \"https://github.com/hegemonic/taffydb/tarball/7d100bcee0e997ee4977e273cdce60bd8933050e\"\n  }\n  ```\n- I use a private registry (Artifactory)\n- NPM v3.9.5; Node v6.2.2 on Amazon Linux (running inside EC2)\n- I can install other packages from my private registry (or `git+ssh` URLs on github and elsewhere) without incident.\n- I can successfully `curl` these URLs from the same server.\n- **I cannot replicate this issue on other machines,** (mostly using MacOS, NPM 3.9.5, and the same private registry -- I don't have access to another EC2 instance to test this with)\n#### Relevant logs\n\n[Gist](https://gist.github.com/schmod/44d93a53269cff06aee3a68e8472e879)\n\nFull logs on request if you think they'll help.\n#### So.....\n\nAs I haven't been able to reproduce this issue, I'm filing a ticket here, in hopes that others have seen something similar, or might have ideas about what could be going on.  Right now, I have no good explanation for why this is happening, or why I am unable to replicate the behavior elsewhere.\n\nSome far-fetched theories:\n- NPM's logs are lying about which URL is 404ing, and NPM is really trying to request some other URL (that legitimately does not exist).\n- I've noticed that remote tarballs use`npm-registry-client`'s `fetch` method, while almost everything else uses `request`.  I don't know what the distinction is between these two methods, but maybe there's a bug in there somewhere?\n- My private registry is interfering somehow.  Given that this is an external tarball, my (private) registry shouldn't be involved in this request at all, but this is also the most unusual aspect of my setup, and therefore the most likely cause of an unreported bug.  \n- Some of the headers that I'd normally send to my registry (ie. auth info) are inadvertently being tacked onto the Github HTTP requests, and Github's server is freaking out about it.\n- Github's servers are freaking out about something else.  Maybe the AWS IP range?\n- There's some specific weirdness with Linux that doesn't exist on MacOS\n\nI have limited shell access to this machine during business hours, so I haven't been able to poke at all combinations of settings or isolate the issue further.\n"}}
{"actor":{"display_login":"npm-robot"}}