Uploaded image for project: 'Dev - Nexus Repo'
  1. Dev - Nexus Repo
  2. NEXUS-27372

Delete of npm package tarball silently fails if the version isn't in package root metadata

    XMLWordPrintable

    Details

    • Type: Bug
    • Status: New
    • Priority: Major
    • Resolution: Unresolved
    • Affects Version/s: 3.30.0
    • Fix Version/s: None
    • Component/s: NPM
    • Labels:
    • Notability:
      3

      Description

      When a user deletes an npm package tarball from a repository, NXRM first checks for its version reference in the package's root level metadata.  This is done so the version can be removed from the metadata.

      If the version is not found in the package level metadata, then the code which would delete the tarball is skipped. Essentially the code silently fails to do the delete the tarball as requested and nothing is logged explaining what happened.

      https://github.com/sonatype/nexus-public/blob/release-3.30.0-01/plugins/nexus-repository-npm/src/main/java/org/sonatype/nexus/repository/npm/internal/orient/NpmHostedComponentMaintenanceImpl.java#L125

      Expected

      There must be a normal way to delete a tarball, even if the package root metadata does not reference it, so:

      1. If a delete operation is aborted for any reason we should clearly log the reason ( applies for any situation, not just this one )
      2. If the version to be deleted is not in the package level metadata we should log this, but then proceed to delete the requested tarball anyways.

       

        Attachments

          Activity

            People

            Assignee:
            Unassigned Unassigned
            Reporter:
            rseddon Rich Seddon
            Last Updated By:
            Rich Seddon Rich Seddon
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

              Dates

              Created:
              Updated:
              Date of First Response:

                tigCommentSecurity.panel-title