Hello 🙂 I’m trying to use a

pnpm

third-party binary (graphql-codegen), but when installing the

node_modules

I’m getting this error:

UNABLE_TO_GET_ISSUER_CERT_LOCALLY  request to <https://registry.npmjs.org/@babel/helper-create-class-features-plugin/-/helper-create-class-features-plugin-7.24.4.tgz> failed, reason: unable to get local issuer certificate

How do I configure pants to allow

pnpm

to install third parties ?

unable to get local issuer cetificate

usually indicates a corporate/mitm/decrypting proxy, or maybe a normal http/so proxy. Is that the case? If so, outside of pants you might be setting a config to use your local CA certificates file instead of bundled ones. I'm not familiar with how pnpm does it, but there's an environment variable for npm or the npmrc file. Pants by default removes environment variables, but you can set them or pass them through with extra_env_vars https://www.pantsbuild.org/2.20/reference/targets/adhoc_tool#extra_env_vars

Hey Daniel

usually indicates a corporate/mitm/decrypting proxy, or maybe a normal http/so proxy. Is that the case?

Nope there’s no proxy at all in my setup. I usually just run

pnpm install

and that’s it

ah, hmm. I tried that config and it seems to work. You can try to diagnose the cert issue by comparing it inside and outside of pants. maybe

openssl s_client -showcerts -connect <http://registry.npmjs.org:443|registry.npmjs.org:443>

outside and

pants run :cert-check

with

run_shell_command(
    name="cert-check",
    command="openssl s_client -showcerts -connect <http://registry.npmjs.org:443|registry.npmjs.org:443>"
)

The topmost section will show you the certificate chain. You can verify that it should be trusted. For me, the chain looks like:

depth=2 C = IE, O = Baltimore, OU = CyberTrust, CN = Baltimore CyberTrust Root
verify return:1
depth=1 C = US, O = "Cloudflare, Inc.", CN = Cloudflare Inc ECC CA-3
verify return:1
depth=0 C = US, ST = California, L = San Francisco, O = "Cloudflare, Inc.", CN = <http://sni.cloudflaressl.com|sni.cloudflaressl.com>
verify return:1

I think ultimately pnpm uses the node certificate bundle in the source, and whatever you're getting as the root should be there