Problem publishing package, am I using it wrong?

[VictorLamoine]

I want to use Verdaccio as a npm registry to cache some dependencies for our build system.

First terminal:

docker run -it --rm --name verdaccio -p 4873:4873 verdaccio/verdaccio:6.0.5
info --- config file  - /verdaccio/conf/config.yaml
info --- the "crypt" algorithm is deprecated consider switch to "bcrypt" in the configuration file. Read the documentation for additional details
info --- using htpasswd file: /verdaccio/storage/htpasswd
info --- plugin successfully loaded: verdaccio-htpasswd
info --- plugin successfully loaded: verdaccio-audit
warn --- http address - http://0.0.0.0:4873/ - verdaccio/6.0.5
info <-- 172.17.0.1 requested 'POST /-/v1/login'
http <-- 200, user: null(172.17.0.1), req: 'POST /-/v1/login', bytes: 15/0
http <-- 404, user: null(172.17.0.1), req: 'POST /-/v1/login', bytes: 15/150
info <-- 172.17.0.1 requested 'PUT /-/user/org.couchdb.user:abc'
http <-- 200, user: null(172.17.0.1), req: 'PUT /-/user/org.couchdb.user:abc', bytes: 141/0
info --- the user abc has been added
http <-- 201, user: abc(172.17.0.1), req: 'PUT /-/user/org.couchdb.user:abc', bytes: 141/112
info <-- 172.17.0.1 requested 'PUT /map-obj'
info --- auth/allow_action: access granted to: abc
info --- abc is allowed publish for map-obj
http <-- 200, user: abc(172.17.0.1), req: 'PUT /map-obj', bytes: 8013/0
info --- making request: 'GET https://registry.npmjs.org/map-obj'
http --- 200, req: 'GET https://registry.npmjs.org/map-obj' (streaming)
http --- 200, req: 'GET https://registry.npmjs.org/map-obj', bytes: 0/32594
http <-- 409, user: abc(172.17.0.1), req: 'PUT /map-obj', error: this package is already present

Second terminal:

npm adduser --registry http://localhost:4873/
git clone [email protected]:sindresorhus/map-obj.git
cd map-obj
npm publish --registry http://localhost:4873/
npm warn publish npm auto-corrected some errors in your package.json when publishing.  Please run "npm pkg fix" to address these errors.
npm warn publish errors corrected:
npm warn publish "repository" was changed from a string to an object
npm warn publish "repository.url" was normalized to "git+https://github.com/sindresorhus/map-obj.git"
npm notice
npm notice 📦  [email protected]
npm notice Tarball Contents
npm notice 3.6kB index.d.ts
npm notice 1.7kB index.js
npm notice 1.1kB license
npm notice 793B package.json
npm notice 2.2kB readme.md
npm notice Tarball Details
npm notice name: map-obj
npm notice version: 5.0.2
npm notice filename: map-obj-5.0.2.tgz
npm notice package size: 3.1 kB
npm notice unpacked size: 9.4 kB
npm notice shasum: c4dfd1bea6ef5e27807bb4ba554cb74affcd5a46
npm notice integrity: sha512-FdxtuNbvwd3bU[...]bORCJcoNdSAcw==
npm notice total files: 5
npm notice
npm notice Publishing to http://localhost:4873/ with tag latest and default access
npm error code E409
npm error 409 Conflict - PUT http://localhost:4873/map-obj - this package is already present
npm error A complete log of this run can be found in: /home/vlamoine/.npm/_logs/2025-04-16T14_58_42_343Z-debug-0.log

Third terminal:

docker exec -it verdaccio sh

$ tree /verdaccio/storage/data/
/verdaccio/storage/data/
└── map-obj
    ├── map-obj-5.0.2.tgz
    └── package.json

1 directories, 2 files

$ cat /verdaccio/storage/data/.verdaccio-db.json 
{"list":[],"secret":"mPbyhBP1caHP09EztEwVrBS1//8ucALl"}~

I am getting an error put the package seems to be published anyway, but it doesn't list on the web interface.
If I try to un-publish it is not deleted from the storage/data directory

What am I understanding wrong?

[juanpicado]

Something to look at, on my list

[VictorLamoine]

info --- making request: 'GET https://registry.npmjs.org/map-obj'
http --- 200, req: 'GET https://registry.npmjs.org/map-obj' (streaming)
http --- 200, req: 'GET https://registry.npmjs.org/map-obj', bytes: 0/32594
http <-- 409, user: abc(172.17.0.1), req: 'PUT /map-obj', error: this package is already present

uplinks:
  npmjs:
    url: https://registry.npmjs.org/

Using docker compose and a custom config.yaml + disabling the uplinks solves the upload issue, but is that the expected behavior?

[juanpicado]

If the package and version already exist on the remote registry should fails unless you add a property tot he config file. Offline publish. The best is publish packages with prerelease if you want to have your own version privately. Anyhow about the tarball already at the storage is something need to check. (Next week)