"IllegalStateException" while unpublish from npm repository

[stepanho]

Details

I faced an issue while trying to execute npm unpublish command on npm-hosted repository.

Looks like that bug was reported earlier on version 3.37.0.

Note that it represents when more than 1 versions of package published.

I also checked versions 3.39.0 and 3.58.1, still not fixed.

You can find error outputs of client and server below.

How to represent

1. Run 'sonatype/nexus3' container
2. Provision Nexus with npm repositories using script
3. Make npm publish for package test-package-name with versions 0.0.1 and 0.0.2
4. Try command npm unpublish [email protected]

Note that if we do it using Delete asset button from GUI, there is no issue.

Client error output

➜  /app: npm unpublish [email protected]
npm ERR! code E500
npm ERR! 500 Server Error - PUT http://nexus:8081/test-package-name/-rev/4

npm ERR! A complete log of this run can be found in:
npm ERR!     /app/.npm/_logs/2023-07-31T08_18_41_521Z-debug-0.log

Server error output

java.lang.IllegalStateException: Package test-package-name lacks tarball version 0.0.1
        at com.google.common.base.Preconditions.checkState(Preconditions.java:826)
        at com.sonatype.nexus.repository.npm.internal.orient.OrientNpmHostedFacetImpl.updateDeprecationFlags(OrientNpmHostedFacetImpl.java:430)
        at com.sonatype.nexus.repository.npm.internal.orient.OrientNpmHostedFacetImpl.putPackageRoot(OrientNpmHostedFacetImpl.java:387)
        at org.sonatype.nexus.transaction.TransactionInterceptor.invoke(TransactionInterceptor.java:49)
        at com.sonatype.nexus.repository.npm.internal.orient.OrientNpmHostedFacetImpl.putPublishRequest(OrientNpmHostedFacetImpl.java:338)
        at org.sonatype.nexus.transaction.TransactionalWrapper.proceedWithTransaction(TransactionalWrapper.java:58)
        at org.sonatype.nexus.transaction.TransactionInterceptor.proceedWithTransaction(TransactionInterceptor.java:66)
        at org.sonatype.nexus.transaction.TransactionInterceptor.invoke(TransactionInterceptor.java:55)
        at com.sonatype.nexus.repository.npm.internal.orient.OrientNpmHostedFacetImpl.putPackage(OrientNpmHostedFacetImpl.java:180)
        at com.sonatype.nexus.repository.npm.internal.NpmHandlers$3.handle(NpmHandlers.java:122)
        at org.sonatype.nexus.repository.view.Context.proceed(Context.java:88)
        at org.sonatype.nexus.repository.storage.UnitOfWorkHandler.handle(UnitOfWorkHandler.java:39)
        at org.sonatype.nexus.repository.view.Context.proceed(Context.java:88)
        at org.sonatype.nexus.repository.view.handlers.ContentHeadersHandler.handle(ContentHeadersHandler.java:46)
        at org.sonatype.nexus.repository.view.Context.proceed(Context.java:88)
        at org.sonatype.nexus.repository.view.handlers.ConditionalRequestHandler.handle(ConditionalRequestHandler.java:67)
        at org.sonatype.nexus.repository.view.Context.proceed(Context.java:88)
        at com.sonatype.nexus.clm.internal.orient.FirewallContributedHandler.handle(FirewallContributedHandler.java:109)
        at org.sonatype.nexus.repository.view.Context.proceed(Context.java:88)
        at org.sonatype.nexus.repository.view.handlers.HandlerContributor.handle(HandlerContributor.java:67)
        at org.sonatype.nexus.repository.view.Context.proceed(Context.java:88)
        at com.sonatype.nexus.repository.npm.internal.NpmHandlers$1.handle(NpmHandlers.java:54)
        at org.sonatype.nexus.repository.view.Context.proceed(Context.java:88)
        at org.sonatype.nexus.repository.security.SecurityHandler.handle(SecurityHandler.java:51)
        at org.sonatype.nexus.repository.view.Context.proceed(Context.java:88)
        at com.sonatype.analytics.internal.handler.AnalyticsMeteringHandler.handle(AnalyticsMeteringHandler.java:69)
        at org.sonatype.nexus.repository.view.Context.proceed(Context.java:88)
        at org.sonatype.nexus.repository.view.handlers.TimingHandler.handle(TimingHandler.java:58)
        at org.sonatype.nexus.repository.view.Context.proceed(Context.java:88)
        at org.sonatype.nexus.repository.view.Context.start(Context.java:179)
        at org.sonatype.nexus.repository.view.Router.dispatch(Router.java:65)
        at org.sonatype.nexus.repository.view.ConfigurableViewFacet.dispatch(ConfigurableViewFacet.java:52)
        at org.sonatype.nexus.repository.view.ConfigurableViewFacet.dispatch(ConfigurableViewFacet.java:43)
        at org.sonatype.nexus.repository.httpbridge.internal.ViewServlet.dispatchAndSend(ViewServlet.java:212)
        at org.sonatype.nexus.repository.httpbridge.internal.ViewServlet.doService(ViewServlet.java:174)
        at org.sonatype.nexus.repository.httpbridge.internal.ViewServlet.service(ViewServlet.java:126)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:790)
        at com.google.inject.servlet.ServletDefinition.doServiceImpl(ServletDefinition.java:290)
        at com.google.inject.servlet.ServletDefinition.doService(ServletDefinition.java:280)
        at com.google.inject.servlet.ServletDefinition.service(ServletDefinition.java:184)
        at com.google.inject.servlet.DynamicServletPipeline.service(DynamicServletPipeline.java:71)
        at com.google.inject.servlet.FilterChainInvocation.doFilter(FilterChainInvocation.java:85)
        at org.apache.shiro.web.servlet.ProxiedFilterChain.doFilter(ProxiedFilterChain.java:61)
        at org.apache.shiro.web.servlet.AdviceFilter.executeChain(AdviceFilter.java:108)
        at org.apache.shiro.web.servlet.AdviceFilter.doFilterInternal(AdviceFilter.java:137)
        at org.apache.shiro.web.servlet.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:154)
        at org.apache.shiro.web.servlet.ProxiedFilterChain.doFilter(ProxiedFilterChain.java:66)
        at org.apache.shiro.web.servlet.AdviceFilter.executeChain(AdviceFilter.java:108)
        at org.apache.shiro.web.servlet.AdviceFilter.doFilterInternal(AdviceFilter.java:137)
        at org.apache.shiro.web.servlet.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:154)
        at org.apache.shiro.web.servlet.ProxiedFilterChain.doFilter(ProxiedFilterChain.java:66)
        at org.apache.shiro.web.servlet.AdviceFilter.executeChain(AdviceFilter.java:108)
        at org.apache.shiro.web.servlet.AdviceFilter.doFilterInternal(AdviceFilter.java:137)
        at org.apache.shiro.web.servlet.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:154)
        at org.apache.shiro.web.servlet.ProxiedFilterChain.doFilter(ProxiedFilterChain.java:66)
        at org.apache.shiro.web.servlet.AdviceFilter.executeChain(AdviceFilter.java:108)
        at org.apache.shiro.web.servlet.AdviceFilter.doFilterInternal(AdviceFilter.java:137)
        at org.apache.shiro.web.servlet.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:154)
        at org.apache.shiro.web.servlet.ProxiedFilterChain.doFilter(ProxiedFilterChain.java:66)
        at org.apache.shiro.web.servlet.AbstractShiroFilter.executeChain(AbstractShiroFilter.java:458)
        at org.sonatype.nexus.security.SecurityFilter.executeChain(SecurityFilter.java:96)
        at org.apache.shiro.web.servlet.AbstractShiroFilter$1.call(AbstractShiroFilter.java:373)
        at org.apache.shiro.subject.support.SubjectCallable.doCall(SubjectCallable.java:90)
        at org.apache.shiro.subject.support.SubjectCallable.call(SubjectCallable.java:83)
        at org.apache.shiro.subject.support.DelegatingSubject.execute(DelegatingSubject.java:387)
        at org.apache.shiro.web.servlet.AbstractShiroFilter.doFilterInternal(AbstractShiroFilter.java:370)
        at org.sonatype.nexus.security.SecurityFilter.doFilterInternal(SecurityFilter.java:112)
        at org.apache.shiro.web.servlet.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:154)
        at com.google.inject.servlet.FilterChainInvocation.doFilter(FilterChainInvocation.java:82)
        at com.codahale.metrics.servlet.AbstractInstrumentedFilter.doFilter(AbstractInstrumentedFilter.java:112)
        at com.google.inject.servlet.FilterChainInvocation.doFilter(FilterChainInvocation.java:82)
        at org.apache.shiro.web.servlet.ProxiedFilterChain.doFilter(ProxiedFilterChain.java:61)
        at org.apache.shiro.web.servlet.AdviceFilter.executeChain(AdviceFilter.java:108)
        at org.apache.shiro.web.servlet.AdviceFilter.doFilterInternal(AdviceFilter.java:137)
        at org.apache.shiro.web.servlet.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:154)
        at org.apache.shiro.web.servlet.ProxiedFilterChain.doFilter(ProxiedFilterChain.java:66)
        at org.apache.shiro.web.servlet.AdviceFilter.executeChain(AdviceFilter.java:108)
        at org.apache.shiro.web.servlet.AdviceFilter.doFilterInternal(AdviceFilter.java:137)
        at org.apache.shiro.web.servlet.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:154)
        at org.apache.shiro.web.servlet.ProxiedFilterChain.doFilter(ProxiedFilterChain.java:66)
        at org.apache.shiro.web.servlet.AdviceFilter.executeChain(AdviceFilter.java:108)
        at org.apache.shiro.web.servlet.AdviceFilter.doFilterInternal(AdviceFilter.java:137)
        at org.apache.shiro.web.servlet.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:154)
        at org.apache.shiro.web.servlet.ProxiedFilterChain.doFilter(ProxiedFilterChain.java:66)
        at org.apache.shiro.web.servlet.AdviceFilter.executeChain(AdviceFilter.java:108)
        at org.apache.shiro.web.servlet.AdviceFilter.doFilterInternal(AdviceFilter.java:137)
        at org.apache.shiro.web.servlet.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:154)
        at org.apache.shiro.web.servlet.ProxiedFilterChain.doFilter(ProxiedFilterChain.java:66)
        at org.apache.shiro.web.servlet.AbstractShiroFilter.executeChain(AbstractShiroFilter.java:458)
        at org.sonatype.nexus.security.SecurityFilter.executeChain(SecurityFilter.java:96)
        at org.apache.shiro.web.servlet.AbstractShiroFilter$1.call(AbstractShiroFilter.java:373)
        at org.apache.shiro.subject.support.SubjectCallable.doCall(SubjectCallable.java:90)
        at org.apache.shiro.subject.support.SubjectCallable.call(SubjectCallable.java:83)
        at org.apache.shiro.subject.support.DelegatingSubject.execute(DelegatingSubject.java:387)
        at org.apache.shiro.web.servlet.AbstractShiroFilter.doFilterInternal(AbstractShiroFilter.java:370)
        at org.sonatype.nexus.security.SecurityFilter.doFilterInternal(SecurityFilter.java:112)
        at org.apache.shiro.web.servlet.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:154)
        at com.google.inject.servlet.FilterChainInvocation.doFilter(FilterChainInvocation.java:82)
        at org.sonatype.nexus.repository.httpbridge.internal.ExhaustRequestFilter.doFilter(ExhaustRequestFilter.java:80)
        at com.google.inject.servlet.FilterChainInvocation.doFilter(FilterChainInvocation.java:82)
        at com.sonatype.nexus.licensing.internal.LicensingRedirectFilter.doFilter(LicensingRedirectFilter.java:116)
        at com.google.inject.servlet.FilterChainInvocation.doFilter(FilterChainInvocation.java:82)
        at com.codahale.metrics.servlet.AbstractInstrumentedFilter.doFilter(AbstractInstrumentedFilter.java:112)
        at com.google.inject.servlet.FilterChainInvocation.doFilter(FilterChainInvocation.java:82)
        at org.sonatype.nexus.internal.web.ErrorPageFilter.doFilter(ErrorPageFilter.java:79)
        at com.google.inject.servlet.FilterChainInvocation.doFilter(FilterChainInvocation.java:82)
        at org.sonatype.nexus.internal.web.EnvironmentFilter.doFilter(EnvironmentFilter.java:101)
        at com.google.inject.servlet.FilterChainInvocation.doFilter(FilterChainInvocation.java:82)
        at org.sonatype.nexus.internal.web.HeaderPatternFilter.doFilter(HeaderPatternFilter.java:98)
        at com.google.inject.servlet.FilterChainInvocation.doFilter(FilterChainInvocation.java:82)
        at com.google.inject.servlet.DynamicFilterPipeline.dispatch(DynamicFilterPipeline.java:104)
        at com.google.inject.servlet.GuiceFilter.doFilter(GuiceFilter.java:133)
        at org.sonatype.nexus.bootstrap.osgi.DelegatingFilter.doFilter(DelegatingFilter.java:73)
        at org.eclipse.jetty.servlet.FilterHolder.doFilter(FilterHolder.java:201)
        at org.eclipse.jetty.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1626)
        at org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:552)
        at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:143)
        at org.eclipse.jetty.security.SecurityHandler.handle(SecurityHandler.java:600)
        at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:127)
        at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:235)
        at org.eclipse.jetty.server.session.SessionHandler.doHandle(SessionHandler.java:1624)
        at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:233)
        at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1440)
        at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:188)
        at org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:505)
        at org.eclipse.jetty.server.session.SessionHandler.doScope(SessionHandler.java:1594)
        at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:186)
        at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1355)
        at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:141)
        at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:127)
        at com.codahale.metrics.jetty9.InstrumentedHandler.handle(InstrumentedHandler.java:239)
        at org.eclipse.jetty.server.handler.HandlerCollection.handle(HandlerCollection.java:146)
        at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:127)
        at org.eclipse.jetty.server.Server.handle(Server.java:516)
        at org.eclipse.jetty.server.HttpChannel.lambda$handle$1(HttpChannel.java:487)
        at org.eclipse.jetty.server.HttpChannel.dispatch(HttpChannel.java:732)
        at org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:479)
        at org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:277)
        at org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:311)
        at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:105)
        at org.eclipse.jetty.io.ChannelEndPoint$1.run(ChannelEndPoint.java:104)
        at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.runTask(EatWhatYouKill.java:338)
        at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.doProduce(EatWhatYouKill.java:315)
        at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.tryProduce(EatWhatYouKill.java:173)
        at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.run(EatWhatYouKill.java:131)
        at org.eclipse.jetty.util.thread.ReservedThreadExecutor$ReservedThread.run(ReservedThreadExecutor.java:409)
        at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:883)
        at org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.run(QueuedThreadPool.java:1034)
        at java.lang.Thread.run(Thread.java:750)

Provisioning script

#!/bin/sh

URL="http://nexus:8081/service/rest";
USERNAME="admin";
PASSWORD="admin123!";
PASSWORD_PATH="./admin.password"
INIT_PASSWORD=$(cat $PASSWORD_PATH || echo "$PASSWORD");

if [ "$INIT_PASSWORD" != "$PASSWORD" ]; then
	curl --request PUT -i \
			--url "$URL/v1/security/users/admin/change-password" \
			--user "$USERNAME:$INIT_PASSWORD" \
			--header "Content-Type: text/plain" \
			--data "$PASSWORD" \
	&& true > $PASSWORD_PATH;
fi

curl --request PUT -i \
    --url "$URL/v1/security/realms/active" \
		--user "$USERNAME:$PASSWORD" \
		--header "Content-Type: application/json" \
		--data '["NexusAuthenticatingRealm", "NexusAuthorizingRealm", "NpmToken"]' \
;

curl --request POST -i \
    --url "$URL/v1/repositories/npm/hosted" \
		--user "$USERNAME:$PASSWORD" \
		--header "Content-Type: application/json" \
		--data '{
      "name": "npm-hosted",
      "online": true,
      "storage": {
        "blobStoreName": "default",
        "strictContentTypeValidation": true,
        "writePolicy": "allow_once"
      },
      "cleanup": {
        "policyNames": []
      },
      "component": {
        "proprietaryComponents": true
      }
    }' \
;

curl --request POST -i \
    --url "$URL/v1/repositories/npm/proxy" \
		--user "$USERNAME:$PASSWORD" \
		--header "Content-Type: application/json" \
		--data '{
			"name": "npm-proxy",
			"online": true,
			"storage": {
				"blobStoreName": "default",
				"strictContentTypeValidation": true
			},
			"cleanup": {
				"policyNames": []
			},
			"proxy": {
				"remoteUrl": "https://registry.npmjs.org",
				"contentMaxAge": 1440,
				"metadataMaxAge": 1440
			},
			"negativeCache": {
				"enabled": false,
				"timeToLive": 1440
			},
			"httpClient": {
				"blocked": false,
				"autoBlock": true
			},
			"routingRule": ""
		}' \
;

curl --request POST -i \
    --url "$URL/v1/repositories/npm/group" \
		--user "$USERNAME:$PASSWORD" \
		--header "Content-Type: application/json" \
		--data '{
			"name": "npm-group",
			"online": true,
			"storage": {
				"blobStoreName": "default",
				"strictContentTypeValidation": true
			},
			"group": {
				"memberNames": ["npm-hosted", "npm-proxy"]
			}
		}' \
;

[nblair]

Thank you @stepanho for opening this issue with exceptional detail - we'll investigate further.

[tallandtree]

Hi, this bug is still present in Nexus 3.68.1-02. Do you have any estimation when this will be solved?