Skip to content

Revert instructions for configure-npm with pnpm #3301

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
s-stumbo wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Revert instructions for configure-npm with pnpm #3301

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 16 additions & 4 deletions content/chainguard/libraries/javascript/build-configuration.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -521,16 +521,28 @@ pnpm init
For testing purposes, you can use direct access and environment variables as
detailed in the [access documentation](/chainguard/libraries/access/#env).

Once
the environment variables are set, the following steps configure registry
Once the environment variables are set, the following steps configure registry
access and authentication in the `.npmrc` file in the current project
directory:

```bash
export token=$(echo -n "${CHAINGUARD_JAVASCRIPT_IDENTITY_ID}:${CHAINGUARD_JAVASCRIPT_TOKEN}" | base64 -w 0)

pnpm config set registry https://libraries.cgr.dev/javascript/ --location=project
Copy link
Copy Markdown
Contributor

@angela-zhang angela-zhang May 6, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

it seems like /javascript-upstream/ is also needed for pnpm, but I'm checking with the engineering team to confirm

pnpm config set //libraries.cgr.dev/javascript/:_auth "${token}" --location=project
```

Note that the `-w 0` option for `base64` is required and supported by the GNU
coreutils versions included in most operating systems. To avoid the use of
`base64`, which can behave differently across operating systems, you can
alternatively set `username` and `_password` instead of `auth` with a token.

```shell
chainctl auth configure-npm --pull-token
pnpm config set //libraries.cgr.dev/javascript/:username "${CHAINGUARD_JAVASCRIPT_IDENTITY_ID}" --location=project
pnpm config set //libraries.cgr.dev/javascript/:_password "${CHAINGUARD_JAVASCRIPT_TOKEN}" --location=project
```

[This command](/chainguard/chainctl/chainctl-docs/chainctl_auth_configure-npm/) creates a pull token (valid for 30 days by default) scoped to your organization and writes a project-level `.npmrc` with the registry URL and base64-encoded credentials. If this command returns an error, ensure that you are using the [latest version of `chainctl`](/chainguard/chainctl-usage/how-to-install-chainctl/#updating-chainctl).
Also note that the trailing slash in the registry URL is required.

Add dependencies for your project into the `package.json` file to test retrieval
from Chainguard Libraries, build the project, and list the dependencies:
Expand Down