[BUG] npm install hangs for several minutes while downloading tarballs from registry that redirects package downloads to s3 links

[jonathanwehner]

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

When using a private npm registry, such as Artifactory, the registry may redirect clients to a pre-signed S3 download link when attempting to download a package. During the install process, the progress bar appears to hang for several minutes at the end. Without the progress bar, install times are as expected. My guess is that it might have something to do with the length of the s3 links (they are much longer than npmjs and regular artifactory links).

The progress bar will stay in this state for several minutes:

For both processes the package download links and dependencies have already been resolved in package-lock.json, node_modules deleted, and cache cleaned:

npm i                                                             ok  02:08:30 PM

added 614 packages, and audited 615 packages in 3m

107 packages are looking for funding
  run `npm fund` for details

found 0 vulnerabilities

npm i --progress=false                                            ok  02:35:53 PM

added 614 packages, and audited 615 packages in 11s

107 packages are looking for funding
  run `npm fund` for details

Expected Behavior

npm install times are comparable to the time it takes when the progress bar is disabled when using registries such as Artifactory

Steps To Reproduce

1. Make sure the npm environment is clean by deleting node_modules and running ‘npm cache clean --force’
2. Configure the npm registry to a registry that redirects package downloads to pre-signed s3 links.
3. Run npm install

Environment

• npm: 8.19.3
• Node.js: 16.16.0
• OS Name: Ventura 32GB
• System Model Name: MacBook Pro Apple M1 Max
  Also reproduced on Ubuntu 20.04 with npm 8.19.3
• npm config:

; "user" config from /Users/xx/.npmrc

//xxxx/artifactory/api/npm/my-npm/:_authToken = (protected)
progress = true
registry = "https://xxxx/artifactory/api/npm/my-npm/"

; node bin location = /Users/xx/.nvm/versions/node/v16.16.0/bin/node
; node version = v16.16.0
; npm local prefix = /Users/xx/packages/my-npm-package
; npm version = 8.19.3
; cwd = /Users/xx/packages/my-npm-package
; HOME = /Users/xx
; Run `npm config ls -l` to show all defaults.

[krave1986]

I have the same issue with the latest version 9.6.7. npm will hang several minutes before doing any installation. It will also failed to do the installation by chance.

[sdalonzo]

Progress is definitely involved. I just debugged a similar issue with an application of Google's Artifact Registry product and npm 9, and it exhibited a very similar behavior (hanging in progress of reify).

Our projects were hanging during npm ci for tens of minutes and sometimes hours (only locally, CI env was fine), and with --no-progress or progress=false, they complete in tens of seconds up to a minute.

https://docs.npmjs.com/cli/v9/using-npm/config#progress says that progress is disabled in known CI environments (ours is GHA which sets CI=true)

I used a lot of npm ci --verbose during the debugging process and observed that the Google Artifact Registry URLs are very long, much longer than the npmjs equivalents, similar to what you've described.

[iarna]

My wild guess would be that the stream piped to are-we-there-yet that results in a redirect is not being closed and that's stopping the npm process from exiting (even though its finished its work) and it keeps the process running until that http stream finally times out. I vaguely recall having seen this in the before times in pacote so if it were me I'd be looking in its successors.

[jpage-godaddy]

This is definitely an issue when using JFrog's Artifactory; it's affects hundreds of engineers at our company. I'm pleading for this to be prioritized! Having to set progress=false to work around it is a bad developer experience. I'm happy to supply logs or to help debug root cause. Sample URL that the progress bar gets "stuck" on:

reify:aws-sdk: http fetch GET 200 https://jfrog-prod-usw2-shared-oregon-main.s3.amazonaws.com/aol-a0sax8tdaku8w/filestore/43/434980d0bee9e67c4764a532577f3a2a54b1c38

It seems like there are some of these that are common culprits. I see it for larger artifacts like aws-sdk and rxjs pretty frequently. I'm not sure yet if it's on the Artifactory side of things (like maybe only some artifacts redirect to S3) or if there's something about large downloads in general that cause the progress to hang.

[Sebi2020]

This is still an issue. Currently setting progress=false is the only workaround.