Registries and networks

Start with:

jup info

The report is offline. It shows the effective registry and TLS source, and says whether credentials are present without showing them.

#Select a registry

Set one npm-compatible registry for all built-in tools:

JUP_NPM_REGISTRY=https://npm.example.com jup cache install

Or set a registry/mirror for one tool:

JUP_REGISTRY_PNPM=https://mirror.example.com jup pnpm --version

The suffix is the upper-case tool name, with punctuation changed to _.

jup chooses a source in this order:

A mirror must provide the package paths and npm metadata expected by the original source. jup checks artifact URLs and refuses a tarball hosted somewhere other than the configured registry.

#Use .npmrc

jup reads a limited set of npm settings from:

It understands registry entries, scoped registries, scoped authentication, certificate settings, and strict-ssl. It does not run commands or support the whole npm configuration language.

A project .npmrc may select registries. It may not supply credentials, certificate authorities, certificate files, or disabled TLS. Put those in a user or global file, or in the CI environment.

Example user .npmrc:

registry=https://npm.example.com/
//npm.example.com/team/:_authToken=${NPM_TOKEN}

jup chooses the longest matching host/path credential scope.

#Authenticate

Prefer a masked CI secret:

JUP_NPM_TOKEN="$TOKEN" jup cache install

For Basic auth, set both:

JUP_NPM_USERNAME=alice JUP_NPM_PASSWORD="$PASSWORD" jup cache install

Credentials apply only to the configured registry origin. jup removes Authorization when a redirect crosses to another origin. URL user information, when present, is redacted from messages.

Use HTTPS for every authenticated registry. Never commit secrets in .jup.env, project .npmrc, or command URLs. jup ignores credentials from project-owned configuration, but other software may not.

#Configure a proxy

jup reads lower-case and upper-case forms of:

• HTTP_PROXY
• HTTPS_PROXY
• ALL_PROXY
• NO_PROXY

Lower-case values win when both are set. HTTP uses an absolute request URL; HTTPS uses CONNECT.

HTTPS_PROXY=http://proxy.example.com:8080 \
NO_PROXY=localhost,.internal.example \
jup cache install

NO_PROXY=* bypasses all proxies. Entries may name a host or host suffix and may include a port.

#Trust a company CA

Add a PEM certificate bundle:

JUP_CAFILE=/etc/company/roots.pem jup cache install

The bundle is added to normal system trust. It must contain PEM certificates and must cover every registry, mirror, redirect, proxy, and key endpoint used by the request.

The same policy can come from a user/global .npmrc with cafile, inline ca, or strict-ssl.

For diagnosis only:

JUP_STRICT_SSL=0 jup cache install

This disables certificate checks and prints a warning when a request is made. Fix the CA chain instead of leaving this setting enabled.

#Timeouts and retries

JUP_NETWORK_TIMEOUT=60000 JUP_NETWORK_RETRIES=5 jup cache install

The timeout covers connecting and idle response time. Retries apply only to safe GET requests and temporary failures, including transport errors, HTTP 408, 425, 429, and server errors. jup does not retry ordinary client errors. Retry count is capped.

#Private-registry checklist

See Security before changing integrity settings.