依赖私有Git仓库的npm install突然失效求助

我的package.json的dependencies中包含依赖项"rtrk": "https://github.com/me/rtrk.git"，此前运行npm install或npm update rtrk均正常。今日执行npm install（npm update表现相同）耗时约8分钟后报错。

已尝试的操作 #

• 回滚应用及依赖包至昨日版本
• 修改package.json中的依赖项为"rtrk": "git+https://github.com/me/rtrk.git"
• 删除node_modules目录与package-lock.json文件
• 执行npm config set cafile C:\laragon\etc\ssl\cacert.pem

以上操作均无效，仅执行npm config set strict-ssl false可临时成功运行命令，但这并非长久方案。

测试设备情况 #

• 两台Windows电脑均出现相同错误
• MacBook可正常执行命令
• 所有设备均无活跃代理

补充疑问 #

移除该依赖后npm可正常工作，这是否真的是证书问题？私有包本身会有证书吗？

错误日志关键片段 #

63 timing idealTree:node_modules/rtrk Completed in 140402ms
64 timing idealTree:node_modules/svelte-radix Completed in 0ms
65 silly placeDep node_modules/rtrk @melt-ui/svelte@0.74.4 OK for: bits-ui@0.18.6 want: 0.74.4
66 silly placeDep node_modules/rtrk nanoid@5.0.7 OK for: bits-ui@0.18.6 want: ^5.0.5
67 silly fetch manifest nanoid@^5.0.4
68 timing idealTree:node_modules/rtrk/node_modules/bits-ui Completed in 8ms
69 timing idealTree:node_modules/rtrk/node_modules/@melt-ui/svelte Completed in 0ms
70 timing idealTree:node_modules/rtrk/node_modules/nanoid Completed in 0ms
71 timing idealTree:node_modules/rtrk/node_modules/tailwind-variants Completed in 0ms
72 timing idealTree:buildDeps Completed in 423551ms
73 timing idealTree:fixDepFlags Completed in 4ms
74 timing idealTree Completed in 423766ms
75 timing reify:loadTrees Completed in 423768ms

190 verbose audit error FetchError: request to https://registry.npmjs.org/-/npm/v1/security/audits/quick failed, reason: unable to verify the first certificate
190 verbose audit error     at ClientRequest.<anonymous> (C:\Users\ratrakone\AppData\Roaming\npm\node_modules\npm\node_modules\minipass-fetch\lib\index.js:130:14)
190 verbose audit error     at ClientRequest.emit (node:events:518:28)
190 verbose audit error     at _destroy (node:_http_client:875:13)
190 verbose audit error     at onSocketNT (node:_http_client:895:5)
190 verbose audit error     at process.processTicksAndRejections (node:internal/process/task_queues:83:21) {
190 verbose audit error   code: 'UNABLE_TO_VERIFY_LEAF_SIGNATURE',
190 verbose audit error   errno: 'UNABLE_TO_VERIFY_LEAF_SIGNATURE',
190 verbose audit error   type: 'system'

195 timing reifyNode:node_modules/rtrk/node_modules/@melt-ui/svelte Completed in 656ms
196 timing reifyNode:node_modules/svelte-radix Completed in 766ms
197 timing reifyNode:node_modules/rtrk/node_modules/bits-ui Completed in 852ms
198 timing reify:rollback:createSparse Completed in 147ms
199 timing reify:rollback:retireShallow Completed in 0ms
200 timing command:install Completed in 494519ms

202 verbose stack FetchError: request to https://codeload.github.com/me/rtrk/tar.gz/ef070543e1b4febb1934379cd12df37e8af9545e failed, reason: unable to verify the first certificate
202 verbose stack     at ClientRequest.<anonymous> (C:\Users\ratrakone\AppData\Roaming\npm\node_modules\npm\node_modules\minipass-fetch\lib\index.js:130:14)
202 verbose stack     at ClientRequest.emit (node:events:518:28)
202 verbose stack     at _destroy (node:_http_client:875:13)
202 verbose stack     at onSocketNT (node:_http_client:895:5)
202 verbose stack     at process.processTicksAndRejections (node:internal/process/task_queues:83:21)
203 verbose cwd C:\custom\dev\my_app
204 verbose Windows_NT 10.0.19045
205 verbose node v20.11.1
206 verbose npm  v10.5.1
207 error code UNABLE_TO_VERIFY_LEAF_SIGNATURE
208 error errno UNABLE_TO_VERIFY_LEAF_SIGNATURE
209 error request to https://codeload.github.com/me/rtrk/tar.gz/ef070543e1b4febb1934379cd12df37e8af9545e failed, reason: unable to verify the first certificate
210 verbose exit 1
211 timing npm Completed in 494896ms
212 verbose unfinished npm timer reify 1713556823504
213 verbose unfinished npm timer reify:unpack 1713557247314
214 verbose unfinished npm timer reifyNode:node_modules/rtrk 1713557247314
215 verbose code 1

我已查阅相关问题，大多指向证书问题，但此前数月（含昨日）均正常运行，对此存疑。

核心问题拆解 #

错误码UNABLE_TO_VERIFY_LEAF_SIGNATURE本质是Node.js验证HTTPS请求的证书链时，无法确认目标服务器叶子证书的有效性。结合Windows设备出问题、Mac正常、移除rtrk后恢复的现象，问题出在Windows系统根证书信任库和GitHub拉取私有仓库的证书验证流程上。

常见疑问解答 #

1. 为什么之前正常现在出问题？
   大概率是Windows系统根证书更新异常，或是GitHub CDN节点的证书链发生变化，而Windows信任库未同步更新对应根/中间证书。Mac的证书信任机制与Windows不同，可能已包含所需证书，因此不受影响。
2. 私有包本身有证书吗？
   私有包本身不需要证书，问题出在拉取包时请求的https://codeload.github.com域名的HTTPS证书验证环节——Node.js找不到受信任的根证书来确认该证书的合法性。

长久解决方案 #

方案1：更新Windows系统根证书

• 打开Windows设置→更新和安全→Windows更新，安装所有可用更新（包括安全类可选更新）。
• 手动导入根证书：按下Win+R输入certmgr.msc打开证书管理器，展开受信任的根证书颁发机构→证书，右键空白处选所有任务→导入，导入微软官方的最新根证书包。

方案2：配置npm使用系统信任证书

• 执行npm config set cafile "C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates"，让npm直接调用Windows系统证书库。
• 或手动导出根证书：在证书管理器中找到GitHub使用的根证书（如DigiCert Global Root CA），导出为PEM格式，再执行npm config set cafile "导出的证书路径.pem"。

方案3：切换为SSH协议拉取私有包

修改package.json依赖项为"rtrk": "git@github.com:me/rtrk.git"，使用SSH协议拉取无需验证HTTPS证书。前提是已在GitHub配置SSH密钥，且Windows上的Git已设置好SSH代理。

方案4：检查杀毒/防火墙软件

部分杀毒软件或防火墙会拦截HTTPS请求并替换证书，导致验证失败。暂时关闭这类软件测试，若恢复正常，需将codeload.github.com和registry.npmjs.org加入信任列表。

内容的提问来源于stack exchange，提问作者narrei