带有私有 git repo 依赖项的 Npm install 停止工作

Question

我有一个

package.json

文件，其中

"rtrk": "https://github.com/me/rtrk.git",

中有

dependencies

条目。 直到今天我都可以正常运行

npm install

或

npm update rtrk

命令并且它们可以工作。

今天，

npm install

（更新行为相同）花了大约 8 分钟才导致错误。

我尝试将应用程序和软件包的版本回滚到昨天的版本。

我尝试将

package.json

条目更改为

"rtrk": "git+https://github.com/me/rtrk.git",

。

我尝试删除

node_modules

目录和

package-lock.json

文件。

我尝试过

npm config set cafile C:\laragon\etc\ssl\cacert.pem

。

这些都没有帮助。

我尝试了

npm config set strict-ssl false

，它允许我运行命令，但这只是一个临时解决方案。

测试设备：两台 Windows 电脑出现相同的错误。 Macbook 可以正常运行命令。

设备没有活动代理。

编辑：如果我从依赖项中删除我的包，npm 就可以工作。那么这真的是证书问题吗？包裹的证书会不会有问题？我的意思是，这个包裹有证书吗？

错误日志中有趣的部分：

63 timing idealTree:node_modules/rtrk Completed in 140402ms
64 timing idealTree:node_modules/svelte-radix Completed in 0ms
65 silly placeDep node_modules/rtrk @melt-ui/[email protected] OK for: [email protected] want: 0.74.4
66 silly placeDep node_modules/rtrk [email protected] OK for: [email protected] want: ^5.0.5
67 silly fetch manifest nanoid@^5.0.4
68 timing idealTree:node_modules/rtrk/node_modules/bits-ui Completed in 8ms
69 timing idealTree:node_modules/rtrk/node_modules/@melt-ui/svelte Completed in 0ms
70 timing idealTree:node_modules/rtrk/node_modules/nanoid Completed in 0ms
71 timing idealTree:node_modules/rtrk/node_modules/tailwind-variants Completed in 0ms
72 timing idealTree:buildDeps Completed in 423551ms
73 timing idealTree:fixDepFlags Completed in 4ms
74 timing idealTree Completed in 423766ms
75 timing reify:loadTrees Completed in 423768ms

190 verbose audit error FetchError: request to https://registry.npmjs.org/-/npm/v1/security/audits/quick failed, reason: unable to verify the first certificate
190 verbose audit error     at ClientRequest.<anonymous> (C:\Users\ratrakone\AppData\Roaming\npm\node_modules\npm\node_modules\minipass-fetch\lib\index.js:130:14)
190 verbose audit error     at ClientRequest.emit (node:events:518:28)
190 verbose audit error     at _destroy (node:_http_client:875:13)
190 verbose audit error     at onSocketNT (node:_http_client:895:5)
190 verbose audit error     at process.processTicksAndRejections (node:internal/process/task_queues:83:21) {
190 verbose audit error   code: 'UNABLE_TO_VERIFY_LEAF_SIGNATURE',
190 verbose audit error   errno: 'UNABLE_TO_VERIFY_LEAF_SIGNATURE',
190 verbose audit error   type: 'system'

195 timing reifyNode:node_modules/rtrk/node_modules/@melt-ui/svelte Completed in 656ms
196 timing reifyNode:node_modules/svelte-radix Completed in 766ms
197 timing reifyNode:node_modules/rtrk/node_modules/bits-ui Completed in 852ms
198 timing reify:rollback:createSparse Completed in 147ms
199 timing reify:rollback:retireShallow Completed in 0ms
200 timing command:install Completed in 494519ms

202 verbose stack FetchError: request to https://codeload.github.com/me/rtrk/tar.gz/ef070543e1b4febb1934379cd12df37e8af9545e failed, reason: unable to verify the first certificate
202 verbose stack     at ClientRequest.<anonymous> (C:\Users\ratrakone\AppData\Roaming\npm\node_modules\npm\node_modules\minipass-fetch\lib\index.js:130:14)
202 verbose stack     at ClientRequest.emit (node:events:518:28)
202 verbose stack     at _destroy (node:_http_client:875:13)
202 verbose stack     at onSocketNT (node:_http_client:895:5)
202 verbose stack     at process.processTicksAndRejections (node:internal/process/task_queues:83:21)
203 verbose cwd C:\custom\dev\my_app
204 verbose Windows_NT 10.0.19045
205 verbose node v20.11.1
206 verbose npm  v10.5.1
207 error code UNABLE_TO_VERIFY_LEAF_SIGNATURE
208 error errno UNABLE_TO_VERIFY_LEAF_SIGNATURE
209 error request to https://codeload.github.com/me/rtrk/tar.gz/ef070543e1b4febb1934379cd12df37e8af9545e failed, reason: unable to verify the first certificate
210 verbose exit 1
211 timing npm Completed in 494896ms
212 verbose unfinished npm timer reify 1713556823504
213 verbose unfinished npm timer reify:unpack 1713557247314
214 verbose unfinished npm timer reifyNode:node_modules/rtrk 1713557247314
215 verbose code 1

我还在 stackoverflow 上查找了 VERIFY_LEAF_SIGNATURE 问题，但这些问题表明存在证书问题，这不应该是我的情况，因为一切都工作了几个月，包括昨天。

Answer 1

ESET 防病毒软件会导致此问题。

这是他们在这个论坛上提到的新“功能”。

可以通过 AV 设置中扫描来解决。

或手动添加证书。这帮助了很多用户，但没有解决我的问题，所以我仍然不得不禁用扫描流量。

损失了四天，gg ESET。