What does git+ssh mean in an npm repo path like git+ssh://[email protected]/xxx.git

Question

I saw an npm repo that is referred to in package.json as git+ssh://[email protected]/xxx.git. I know this is ssh protocol, but I don't know what git+ssh does as when cloning the repo, I only use [email protected]/xxx.git. I googled around but cannot hit any result on this.

Answer 1

When hosting npm packages via git, npm also needs to know which transfer protocol to use to transfer the package files from the repo to the client. For this the following options exist: ssh, https, http, file (see https://docs.npmjs.com/cli/install).

The creators of npm decided to place this information in the protocol name separating the information with a + symbol so it becomes more schematic. So when npm install iterates over your dependencies and sees a dependency with git+ssh it knows that it will connect to the repo via ssh and then use your local git binaries to checkout the project files locally.

I guess they could have also named the protocol gitwithssh as in gitwithssh://[email protected]/xxx.git but git+ssh looks just more concise and logically separated, thus easier to parse via a regex.

Here is the part in the npm source code that is actually responsible for splitting the protocol information into the type (= git) and the actual protocol (e.g. ssh): https://github.com/npm/npm-package-arg/blob/v7.0.0/npa.js#L221

I only use [email protected]/xxx.git.

You cannot use this format to register a package as dependency with npm. Try executing npm i [email protected]/xxx.git – it won't work. This format can only be used e.g. via git clone.

However, you can use this format when prefixing it with the ssh protocol: ssh://[email protected]/xxx.git. This is actually the "normalized" form of "git+ssh" which is used by npm behind the curtains (see also how https://github.com/npm/normalize-git-url transforms your git+ssh://... into ssh://git@...).