从git获取npm包的不同协议

Question

From the npm docs ( https://docs.npmjs.com/cli/install )

The following is not completely clear:

npm install <git remote url>:

Installs the package from the hosted git provider, cloning it with git. First it tries via the https (git with github) and if that fails, via ssh.

    <protocol>://[<user>[:<password>]@]<hostname>[:<port>][:][/]<path>[#<commit-ish>]

<protocol> is one of git, git+ssh, git+http, or git+https.

What is the differene between these 4 options (git, git+ssh, ...)?

Answer 1

For full details, read Git on the Server - The Protocols .

All of the protocols negotiate the file transfers you need to clone/pull/push a repository; they differ mostly in their authentication mechanism.

git

This talks directly to the daemon that comes packaged with Git - you can just spin it up and hand out a URL. It has no authentication on it, so you typically don't want to allow push over it (everyone with the URL could push), but that saves on overhead and makes it a good option for mass public distribution (like NPM).

git+ssh

The same as git , just transported over SSH. You have to have an SSH key set up with the server, but for the trouble you get authentication and encryption.

git+http

This comes in two modes, Dumb and Smart.

Dumb HTTP is basically the repository served by a standard web server, which is easy to set up, but can make for slow transfers because the client has to walk commits and request entire packfiles even if it only needs one object in the file. Serving this way is read only because the web server can't receive files appropriately.

Smart HTTP was introduced in 1.6.6 and lets the client request specific objects like it does with git and git+ssh . The server can then make a custom packfile to send back, which is much more efficient. The smarter server can also now support pushes, though again you'll want to authenticate the user.

git+https

The same as git+http , but over HTTPS, so you get authentication and encryption. The nice thing over git+ssh is you can use a simple username and password instead of having to set up a key pair, which is easier for a lot of users.