Bug: Invalid tar header

[elahn]

Yarn version: 0.23.2
Node version: v7.9.0
OS: Microsoft Windows [Version 10.0.15063]

> yarn global add ember-cli/ember-cli
yarn global v0.23.2
warning No license field
[1/4] Resolving packages...
[2/4] Fetching packages...
error An unexpected error occurred: "https://registry.yarnpkg.com/jsonfile/-/jsonfile-2.4.0.tgz: Invalid tar header. Maybe the tar is corrupted or it needs to be gunzipped?".

yarn-error.log

[pho3nixf1re]

I am seeing the same thing with the same listed versions as OP. However, I am on macOS 10.12.4. Another thing to note is that I am using a private Gemfury proxy.

[pho3nixf1re]

Also of note is that I get a similar error on v0.22.0 only worded differently invalid tar file

[jbreckel]

I get the same error when I publish our private (scoped) package with yarn publish.
When using npm version patch && npm publish everything works fine.

Both times I used yarn upgrade to get the new version.

[mijamo]

Same error when I publish a public package through yarn publish and then install it through yarn add (package react-thumbor-img). Publishing through npm publish also solved the problem.

[joshgillies]

I think this may be a duplicate of #2764 ?

[jbreckel]

possibly, but the error message is different.

If the error occurs while packaging, it may break differently on different systems.

[wyattjoh]

Yarn version: 0.23.3
Node version: v7.9.0
OS: macOS 10.12.4 (16E195)

Also experiencing the same issue with the following:

$ yarn add @coralproject/coral-plugin-trust@^1.0.0
yarn add v0.23.3
[1/4] 🔍  Resolving packages...
[2/4] 🚚  Fetching packages...
error An unexpected error occurred: "https://registry.yarnpkg.com/@coralproject/coral-plugin-trust/-/coral-plugin-trust-1.0.0.tgz: Invalid tar header. Maybe the tar is corrupted or i
t needs to be gunzipped?".
info If you think this is a bug, please open a bug report with the information provided in "/Users/wyattjohnson/Code/github.com/coralproject/talk/yarn-error.log".
info Visit https://yarnpkg.com/en/docs/cli/add for documentation about this command.

yarn-error.log.txt

[wyattjoh]

Yet when I download the linked file directly from the url logged out, I get a tar file that I can untar properly:

curl https://registry.yarnpkg.com/@coralproject/coral-plugin-trust/-/coral-plugin-trust-1.0.0.tgz | tar xz

[neolivz]

I wasted a couple of hours on this. I think the publish is not gzipping the tarball.

[wyattjoh]

I may have thought this as well @neolivz, but I was able to untar the file via tar xz which to me implies that it was gzipped,

[gss2002]

This is also plaguing downloads through corporate proxy servers. It's very frustrating when attempting to build projects like Zeppelin/Ambari. They both have flipped their projects to yarn which is great for the yarnpkg project but the problem is if you cannot download the packages because the corporate proxy servers are scanning the tgz and only sending a byte or two at a time until it completes scanning. NPM does not have this problem any thoughts on how this can be solved with yarn?

I can provide more details if needed beyond this:

[INFO] verbose 9.811 Performing "GET" request to "http://registry.npmjs.org/pify".
[INFO] verbose 9.823 Request "http://registry.npmjs.org/pify" finished with status code 200.
[INFO] verbose 9.823 Performing "GET" request to "http://registry.npmjs.org/error-ex".
[INFO] verbose 9.838 Request "http://registry.npmjs.org/error-ex" finished with status code 200.
[INFO] verbose 9.839 Performing "GET" request to "http://registry.npmjs.org/is-arrayish".
[INFO] verbose 9.844 Request "http://registry.npmjs.org/is-arrayish" finished with status code 200.
[INFO] [2/4] Fetching packages...
[INFO] verbose 10.084 Performing "GET" request to "https://registry.yarnpkg.com/npm/-/npm-2.14.10.tgz".
[INFO] verbose 28.947 Error: https://registry.yarnpkg.com/npm/-/npm-2.14.10.tgz: Invalid tar header. Maybe the tar is corrupted or it needs to be gunzipped?
[INFO] at Object.exports.decode (/data/home/gss2002/ambari/contrib/views/files/src/main/resources/ui/node/yarn/dist/node_modules/tar-stream/headers.js:265:40)
[INFO] at onheader (/data/home/gss2002/ambari/contrib/views/files/src/main/resources/ui/node/yarn/dist/node_modules/tar-stream/extract.js:120:39)
[INFO] at Extract._write (/data/home/gss2002/ambari/contrib/views/files/src/main/resources/ui/node/yarn/dist/node_modules/tar-stream/extract.js:243:8)
[INFO] at doWrite (/data/home/gss2002/ambari/contrib/views/files/src/main/resources/ui/node/yarn/dist/node_modules/readable-stream/lib/_stream_writable.js:338:64)
[INFO] at writeOrBuffer (/data/home/gss2002/ambari/contrib/views/files/src/main/resources/ui/node/yarn/dist/node_modules/readable-stream/lib/_stream_writable.js:327:5)
[INFO] at Writable.write (/data/home/gss2002/ambari/contrib/views/files/src/main/resources/ui/node/yarn/dist/node_modules/readable-stream/lib/_stream_writable.js:264:11)
[INFO] at UnpackStream.ondata (_stream_readable.js:542:20)
[INFO] at emitOne (events.js:77:13)
[INFO] at UnpackStream.emit (events.js:169:7)
[INFO] at readableAddChunk (_stream_readable.js:153:18)
[ERROR] error An unexpected error occurred: "https://registry.yarnpkg.com/npm/-/npm-2.14.10.tgz: Invalid tar header. Maybe the tar is corrupted or it needs to be gunzipped?".
[INFO] info If you think this is a bug, please open a bug report with the information provided in "/data/home/gss2002/ambari/contrib/views/files/src/main/resources/ui/yarn-error.log".
[INFO] info Visit https://yarnpkg.com/en/docs/cli/install for documentation about this command./

[h3adache]

I think this is the same as #1619? It's preventing me from using yarn atm.

[Ranger1230]

I get this error occasionally too. It seems to happen when in the package.json you allow newer versions of a package (using ^ or ~) and the package is recently updated. It doesn't always happen though. My guess is something on the NPM site sometimes causes those headers to not get properly created right away. I think npm handles this by trying to download the latest version, and if the header is invalid move to a older version until it finds one with valid headers.
If it helps at all at this moment I'm getting this error for this package http://registry.npmjs.org/compression/-/compression-1.7.2.tgz

Using Reslet Client here is the header response I get.
X-Bst-Request-Id: Qfm38h:zMl:9985
X-Bst-Info: t=1522763889,h=25n,p=201146_604:1_2382,u=1978364541,c=2339,v=7.9.58904.134
Content-Type: application/octet-stream
Server: UploadServer
Cache-Control: max-age=432000
Last-Modified: Tue, 29 Sep 2009 17:21:33 GMT
ETag: "4ac2421d-1dff"
x-npm-region: US-Central
Content-Length: 7679
Accept-Ranges: bytes
Date: Tue, 03 Apr 2018 13:58:09 GMT
Via: 1.1 varnish, 1.1 hosted.websense 25n
Age: 382699
X-Served-By: cache-mdw17338-MDW
X-Cache: HIT
X-Cache-Hits: 166
X-Timer: S1522763889.100250,VS0,VE0
Connection: keep-alive