@pnpm/fetching.git-fetcher 1102.0.13 → 1102.0.15

package/CHANGELOG.md

@@ -1,5 +1,28 @@
 # @pnpm/git-fetcher
 
+## 1102.0.15
+
+### Patch Changes
+
+- Updated dependencies:
+  - @pnpm/error@1100.1.3
+  - @pnpm/exec.prepare-package@1100.0.33
+  - @pnpm/fetching.fetcher-base@1100.2.8
+  - @pnpm/resolving.git-resolver@1100.1.18
+  - @pnpm/store.index@1100.2.5
+
+## 1102.0.14
+
+### Patch Changes
+
+- A git dependency whose clone (or shallow fetch) fails now reports which package it belongs to, under the `ERR_PNPM_GIT_FETCH_FAILED` code, with credentials in the repository URL redacted. When the lockfile records an SSH remote, the error also explains that fetching it needs an SSH key for that host, and that a lockfile entry written before pnpm v11.21 can be re-recorded over HTTPS with `pnpm update <package>` [#13743](https://github.com/pnpm/pnpm/issues/13743).
+
+- Updated dependencies:
+  - @pnpm/error@1100.1.2
+  - @pnpm/exec.prepare-package@1100.0.32
+  - @pnpm/resolving.git-resolver@1100.1.17
+  - @pnpm/store.index@1100.2.4
+
 ## 1102.0.13
 
 ### Patch Changes

package/lib/index.js

@@ -2,7 +2,7 @@ import assert from 'node:assert';
 import path from 'node:path';
 import { URL } from 'node:url';
 import util from 'node:util';
-import { PnpmError } from '@pnpm/error';
+import { PnpmError, redactAndSanitize, redactAndSanitizeMultiline } from '@pnpm/error';
 import { preparePackage } from '@pnpm/exec.prepare-package';
 import { packlist } from '@pnpm/fs.packlist';
 import { globalWarn } from '@pnpm/logger';
@@ -18,13 +18,19 @@ export function createGitFetcher(createOpts) {
             throw new PnpmError('INVALID_GIT_COMMIT', `Invalid git commit hash "${resolution.commit}" for repository "${resolution.repo}". Expected a 40-character hexadecimal SHA.`);
         }
         const tempLocation = await cafs.tempDir();
-        if (allowedHosts.size > 0 && shouldUseShallow(resolution.repo, allowedHosts)) {
-            await execGit(['init'], { cwd: tempLocation });
-            await execGit(['remote', 'add', 'origin', resolution.repo], { cwd: tempLocation });
-            await execGit(['fetch', '--depth', '1', 'origin', resolution.commit], { cwd: tempLocation });
+        try {
+            if (allowedHosts.size > 0 && shouldUseShallow(resolution.repo, allowedHosts)) {
+                await execGit(['init'], { cwd: tempLocation });
+                await execGit(['remote', 'add', 'origin', resolution.repo], { cwd: tempLocation });
+                await execGit(['fetch', '--depth', '1', 'origin', resolution.commit], { cwd: tempLocation });
+            }
+            else {
+                await execGit(['clone', resolution.repo, tempLocation]);
+            }
         }
-        else {
-            await execGit(['clone', resolution.repo, tempLocation]);
+        catch (err) {
+            assert(util.types.isNativeError(err));
+            throw gitFetchError(err, resolution.repo, opts.pkg?.name);
         }
         await execGit(['checkout', resolution.commit], { cwd: tempLocation });
         const receivedCommit = await execGit(['rev-parse', 'HEAD'], { cwd: tempLocation });
@@ -73,6 +79,77 @@ export function createGitFetcher(createOpts) {
 function isValidCommitHash(commit) {
     return /^[0-9a-f]{40}$/i.test(commit);
 }
+/**
+ * Restate a failure of the transport-touching git invocations, naming the
+ * package the resolution belongs to.
+ *
+ * Every interpolated value is untrusted: a lockfile URL can carry `user:pass@`
+ * credentials, and git echoes it back through stderr. Only the values go
+ * through {@link redactAndSanitize} — it strips control characters, which would
+ * collapse the deliberately multi-line hint.
+ */
+function gitFetchError(err, repo, pkgName) {
+    if (err.code === 'ENOENT') {
+        return new PnpmError('GIT_FETCHER_GIT_NOT_FOUND', '`git` executable not found on PATH. Install git to fetch git-hosted packages.');
+    }
+    const safePkgName = pkgName == null ? undefined : redactAndSanitize(pkgName);
+    const subject = safePkgName == null ? '' : `"${safePkgName}" `;
+    return new PnpmError('GIT_FETCH_FAILED', `Failed to fetch ${subject}from the git repository "${redactAndSanitize(repo)}": ${redactAndSanitizeMultiline(gitFailureDetail(err))}`, { hint: sshRemediationHint(repo, safePkgName) });
+}
+// git appends the child's stderr to its own message, which repeats the repository
+// and leaks the store's temp directory. The stderr alone is what the user needs.
+function gitFailureDetail(err) {
+    const stderr = err.stderr?.trim();
+    return stderr == null || stderr === '' ? err.message : stderr;
+}
+/**
+ * Guidance for a git dependency locked to an SSH remote, or `undefined` when the
+ * lockfile records a transport that needs no key.
+ *
+ * A lockfile written before pnpm v11.21 could record an SSH URL for a dependency
+ * whose specifier never asked for SSH, and resolution is skipped while that
+ * lockfile stays up to date — so the entry survives the upgrade that fixed it and
+ * the install keeps failing wherever no SSH key is configured.
+ */
+function sshRemediationHint(repo, pkgName) {
+    const host = sshRepoHost(repo);
+    if (host == null)
+        return undefined;
+    return `The lockfile records an SSH remote for this dependency, so fetching it needs an SSH key for ${redactAndSanitize(host)}.
+
+If its specifier does not ask for SSH (for example "github:owner/repo"), the lockfile entry was written before pnpm v11.21 and can be re-recorded over HTTPS:
+
+    pnpm update ${pkgName ?? '<package>'}
+
+"pnpm install --force" and "pnpm install --resolution-only" do not re-resolve git dependencies, so neither clears it.`;
+}
+/**
+ * The host an SSH git reference points at, or `undefined` if `repo` is not one.
+ *
+ * Covers the URL form (`[git+]ssh://[user@]host[:port]/path`) and the scp-style
+ * shorthand (`[user@]host:path`) that carries no scheme. The `user@` is mandatory
+ * in the shorthand, which is what keeps a Windows drive path (`C:\repo`) from
+ * being read as a host.
+ */
+function sshRepoHost(repo) {
+    const sshUrl = repo.replace(/^git\+/, '');
+    if (sshUrl.startsWith('ssh://')) {
+        try {
+            return new URL(sshUrl).hostname || undefined;
+        }
+        catch {
+            return undefined;
+        }
+    }
+    if (repo.includes('://'))
+        return undefined;
+    const colonPos = repo.indexOf(':');
+    if (colonPos === -1)
+        return undefined;
+    const authority = repo.slice(0, colonPos);
+    const atPos = authority.lastIndexOf('@');
+    return atPos === -1 ? undefined : authority.slice(atPos + 1) || undefined;
+}
 function shouldUseShallow(repoUrl, allowedHosts) {
     try {
         const { host } = new URL(repoUrl);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/fetching.git-fetcher",
-  "version": "1102.0.13",
+  "version": "1102.0.15",
   "description": "A fetcher for git-hosted packages",
   "keywords": [
     "pnpm",
@@ -28,27 +28,27 @@
     "!*.map"
   ],
   "dependencies": {
-    "@pnpm/error": "1100.1.1",
-    "@pnpm/exec.prepare-package": "1100.0.31",
-    "@pnpm/fetching.fetcher-base": "1100.2.7",
+    "@pnpm/error": "1100.1.3",
+    "@pnpm/exec.prepare-package": "1100.0.33",
+    "@pnpm/fetching.fetcher-base": "1100.2.8",
     "@pnpm/fs.packlist": "1100.0.4",
-    "@pnpm/resolving.git-resolver": "1100.1.16",
-    "@pnpm/store.index": "1100.2.3",
+    "@pnpm/resolving.git-resolver": "1100.1.18",
+    "@pnpm/store.index": "1100.2.5",
     "@zkochan/rimraf": "^4.0.0",
     "execa": "npm:safe-execa@0.3.0"
   },
   "peerDependencies": {
     "@pnpm/logger": "^1100.0.0",
-    "@pnpm/worker": "^1100.2.10"
+    "@pnpm/worker": "^1100.3.0"
   },
   "devDependencies": {
     "@jest/globals": "30.4.1",
-    "@pnpm/fetching.git-fetcher": "1102.0.13",
+    "@pnpm/fetching.git-fetcher": "1102.0.15",
     "@pnpm/logger": "1100.0.0",
-    "@pnpm/store.cafs": "1100.1.18",
-    "@pnpm/store.create-cafs-store": "1100.0.24",
+    "@pnpm/store.cafs": "1100.2.0",
+    "@pnpm/store.create-cafs-store": "1100.0.26",
     "@pnpm/text.ordinal-comparator": "1100.0.0",
-    "@pnpm/types": "1101.9.0",
+    "@pnpm/types": "1102.0.0",
     "tempy": "3.0.0"
   },
   "engines": {