Local versions on macOS:
❯ npm --version
5.7.1
❯ node --version
v8.9.3
Remote versions: Node 8.10.0, npm 5.7.1 on Ubuntu 16.04
This package-lock.json was created on my local machine where I have access to github:heroku/private-node-module.
It's a dummy module that depends on express.
When I try to install using npm install --production=true on a machine that has not been given access to
this module I get the following error:
Installing node modules (package.json + package-lock)
npm ERR! Error while executing:
npm ERR! /usr/bin/git ls-remote -h -t ssh://git@github.com/heroku/private-node-module.git
npm ERR!
npm ERR! Host key verification failed.
npm ERR! fatal: Could not read from remote repository.
npm ERR!
npm ERR! Please make sure you have the correct access rights
npm ERR! and the repository exists.
npm ERR!
npm ERR! exited with error code: 128
With loglevel set to silly this looks like:
Installing node modules (package.json + package-lock)
npm info it worked if it ends with ok
npm verb cli [ '/tmp/build_f8ef3cafbf91e9657f7507dec2ffc792/.heroku/node/bin/node',
npm verb cli '/tmp/build_f8ef3cafbf91e9657f7507dec2ffc792/.heroku/node/bin/npm',
npm verb cli 'install',
npm verb cli '--production=true',
npm verb cli '--unsafe-perm',
npm verb cli '--userconfig',
npm verb cli '/tmp/build_f8ef3cafbf91e9657f7507dec2ffc792/.npmrc' ]
npm info using npm@5.7.1
npm info using node@v8.10.0
npm verb config Skipping project config: /tmp/build_f8ef3cafbf91e9657f7507dec2ffc792/.npmrc. (matches userconfig)
npm verb npm-session 85d18004d6c64c7c
npm sill install runPreinstallTopLevelLifecycles
npm sill preinstall npm-5-devdependency-repro@
npm info lifecycle npm-5-devdependency-repro@~preinstall: npm-5-devdependency-repro@
npm sill install loadCurrentTree
npm sill install readLocalPackageData
npm sill install loadIdealTree
npm sill install cloneCurrentTreeToIdealTree
npm sill install loadShrinkwrap
npm sill fetchPackageMetaData error for private-node-module@github:heroku/private-node-module#fad3fc386f621c13f44351c3e851c95a7c4cfba7 Error while executing:
npm sill fetchPackageMetaData /usr/bin/git ls-remote -h -t ssh://git@github.com/heroku/private-node-module.git
npm sill fetchPackageMetaData
npm sill fetchPackageMetaData Host key verification failed.
npm sill fetchPackageMetaData fatal: Could not read from remote repository.
npm sill fetchPackageMetaData
npm sill fetchPackageMetaData Please make sure you have the correct access rights
npm sill fetchPackageMetaData and the repository exists.
npm sill fetchPackageMetaData
npm sill fetchPackageMetaData exited with error code: 128
npm sill saveTree npm-5-devdependency-repro@
npm verb stack Error: exited with error code: 128
npm verb stack at ChildProcess.onexit (/tmp/build_f8ef3cafbf91e9657f7507dec2ffc792/.heroku/node/lib/node_modules/npm/node_modules/pacote/node_modules/mississippi/node_modules/end-of-stream/index.js:39:36)
npm verb stack at emitTwo (events.js:126:13)
npm verb stack at ChildProcess.emit (events.js:214:7)
npm verb stack at Process.ChildProcess._handle.onexit (internal/child_process.js:198:12)
npm verb cwd /tmp/build_f8ef3cafbf91e9657f7507dec2ffc792
npm verb Linux 4.4.0-1012-aws
npm verb argv "/tmp/build_f8ef3cafbf91e9657f7507dec2ffc792/.heroku/node/bin/node" "/tmp/build_f8ef3cafbf91e9657f7507dec2ffc792/.heroku/node/bin/npm" "install" "--production=true" "--unsafe-perm" "--userconfig" "/tmp/build_f8ef3cafbf91e9657f7507dec2ffc792/.npmrc"
npm verb node v8.10.0
npm verb npm v5.7.1
npm ERR! Error while executing:
npm ERR! /usr/bin/git ls-remote -h -t ssh://git@github.com/heroku/private-node-module.git
npm ERR!
npm ERR! Host key verification failed.
npm ERR! fatal: Could not read from remote repository.
npm ERR!
npm ERR! Please make sure you have the correct access rights
npm ERR! and the repository exists.
npm ERR!
npm ERR! exited with error code: 128
npm verb exit [ 1, true ]
npm ERR! A complete log of this run can be found in:
npm ERR! /tmp/npmcache.dEHyU/_logs/2018-03-08T21_49_36_102Z-debug.lo
This is unintuitive to the user since the dependency won't be downloaded on the remote machine. Now they have to add auth tokens to allow access to a module they don't need.