GitHub Packages as npm proxy - Sonatype Nexus Repository - Sonatype Community

GitHub Packages as npm proxy

post by mareksierocinski on Oct 1, 2020

Hello,

is it possible to configure Nexus to use GitHub Packages as a npm proxy? HTTP authentication option doesn’t seem to work.

Here are GitHub docs how to do it locally: Configuring npm for use with GitHub Packages - GitHub Docs

But no luck with Nexus npm proxy.

post by mareksierocinski on Oct 1, 2020

Update: I have updated Nexus to the newest Linux version (OSS 3.27.0-03). Now I have the option to setup HTTP Authentication as “Preemptive Bearer Token”. And now, it seems that Nexus can talk with GitHub npm repo, but there must be some bug, because downloading tarball does not work. It responds with 404.

Help please?

post by mareksierocinski on Oct 1, 2020

Update 2 and solution:

In my opinion, there is some serious bug in Nexus. But it works. What you need to do is to use basic HTTP Username authentication, using your GitHub username as the username and your personal token as the password. Now you must uncheck the checkbox “Validate that all content uploaded to this repository is of a MIME type appropriate for the repository format”… Which is unnecessary.

It will NOT work with “Preemptive Bearer Token”.

Sonatype, please fix this…

post by mareksierocinski on Oct 3, 2020

Update 3:

Ok, that was not a solution. It seemed to work, but it didn’t - I was not able to install any other version of the package without invalidating the cache.

Here is a PR with the fix: NEXUS-23750 - Does not support npm GitHub Package Registry by marverix · Pull Request #79 · sonatype/nexus-public · GitHub

About issues and fixes:

First problem

Nexus is using HttpClient 4.5, which is using since version 4.1 DefaultRedirectStrategy. According to the documentation:

302 Moved Temporarily, 301 Moved Permanently and 307 Temporary Redirect status codes will result in an automatic redirect of HEAD and GET methods only.

and (probably) HttpClient is copying all headers from the original request. Normally it’s not an issue, but GitHub Package Registry is redirecting (with 302) to an automatically generated AWS (S3 probably) link with the X-Amz-Credential GET parameter. AWS does not allow us to use both the Authorization Bearer token and the mentioned X-Amz-Credential, resulting in HTTP 400.

The fix is to manually handle redirects, enabling control over whether we add the Authorization Bearer header by checking for the existence of X-Amz-Credential.

Second problem

In the NpmContentValidator, Nexus was always adding a .json extension if there was no extension at all. This was incorrect. Npm packages’ names in AWS are just random hashes without extension. Those are application/octet-stream, indicating the tarball expected.

The fix is to check if the declared content type is application gzip. If so, append .tgz instead of .json.

post by prashantthakur666 on Aug 5, 2022

I am facing a similar issue of 404 which started coming abruptly.

We are on Nexus version -3.38.1

node version - v18.7.0

pnpm version - v7.8.0

I am using the proxy repo to connect to GitHub and tried testing using the bearer token and username/password as token.

Nothing changed on Nexus, and things were working fine.

post by emeric.colombe on May 24, 2023

Hi Prashant, did you find a solution to your problem ?

I’m trying to install npm package aframe@1.3.0, but it fails on its three-bmfont-text dependency because it is hosted on GitHub.

post by joris.klop on Sep 18, 2023

Hi All,

Just got the proxy to GitHub Packages working on Nexus Repository 3.55 with the following:

Hope the above helps!

Kind regards,

Joris

post by email on May 7, 2024

Hi All,

will this also work for Maven artifacts? (pom.xml, *.jar, …) ?

I’m trying to set up a proxy Repo in Nexus for my GitHub package(s) - but couldn’t get that working.

Any advice would be very appreciated.

Thx, Torsten