Understanding proxies and publishing

[Nessworthy]

Hiya!

Would you be able to help fill me in on some interactions when working with uplinks from a private registry?

Say I publish packages to a private verdaccio server with a specific scope, but then I would also like to publish / fetch "public" packages with the same scope on the global npmjs registry, is that a thing you could do with verdaccio? I wasn't sure on:

1. Setting up a proxy to npmjs when you have locally hosted packages - would verdaccio prioritize locally hosted packages if requested, and fall back to the proxy?

   1. How would it interact with the proxy cache if one was to be used?

2. Would publishing to the verdaccio repo also attempt to publish it upstream?

   1. Does that interaction change at all if the package exists locally (not just cached), or only exists upstream?

Love using verdaccio and checking out all the updated features, thanks for the effort put into this package!

[juanpicado]

but then I would also like to publish / fetch "public" packages with the same scope on the global npmjs registry, is that a thing you could do with verdaccio? I

Verdaccio only fetches from upstreams if is setup in such way (by default), ⬇️ ( never publish), never by design.

would verdaccio prioritize locally hosted packages if requested, and fall back to the proxy?

Verdaccio will update and merge metadata (pakuments) for each request if you have the proxy property on the package access but will prioritize tarballs that are already on the storage (cache), does not make sense to download them again. So, if you want to have a public @scope and private @scope that's possible, but versions, time any part of the metadata will be merged. Eg: if you have @scope/[email protected] in npmjs, then you try to publish the same version as private, verdaccio will return publish conflict error since already exist in one upstream (npmjs), on this way we avoid conflicts.

So, To avoid conflicts, I'd recommend publishing private packages with some sort of snapshot approach as versioning so never conflicts with the upstreams, like @scope/[email protected] or stuff like that with dist-tag usage or npm publish --tag alpha. Keep separation of concerns also help verdaccio to be more effective with the merge.

Would publishing to the verdaccio repo also attempt to publish it upstream?

No, verdaccio never publishes on upstreams.

Love using verdaccio and checking out all the updated features, thanks for the effort put into this package! #2286

thanks 💯 ! , don't forget the 🌟 😉