{"record":{"id":"61c693e6759c7b30","repo":"oven-sh/bun","slug":"tarballhttp403","errorCode":null,"errorMessage":"TarballHTTP403","messagePattern":"TarballHTTP403","errorType":"error_code","errorClass":"bun_install::Error","httpStatus":403,"severity":"error","filePath":"src/install/error.rs","lineNumber":25,"sourceCode":"    #[error(\"NotDir\")]\n    NotDir,\n    #[error(\"NameTooLong\")]\n    NameTooLong,\n    #[error(\"SymLinkLoop\")]\n    SymLinkLoop,\n    #[error(\"SystemFdQuotaExceeded\")]\n    SystemFdQuotaExceeded,\n    #[error(\"SystemResources\")]\n    SystemResources,\n    #[error(\"DeviceBusy\")]\n    DeviceBusy,\n    #[error(\"TarballHTTP400\")]\n    TarballHTTP400,\n    #[error(\"TarballHTTP401\")]\n    TarballHTTP401,\n    #[error(\"TarballHTTP402\")]\n    TarballHTTP402,\n    #[error(\"TarballHTTP403\")]\n    TarballHTTP403,\n    #[error(\"TarballHTTP404\")]\n    TarballHTTP404,\n    #[error(\"TarballHTTP4xx\")]\n    TarballHTTP4xx,\n    #[error(\"TarballHTTP5xx\")]\n    TarballHTTP5xx,\n    #[error(\"TarballFailedToExtract\")]\n    TarballFailedToExtract,\n    #[error(\"TarballFailedToDownload\")]\n    TarballFailedToDownload,\n    #[error(\"BadRequest\")]\n    BadRequest,\n    #[error(\"TooManyRequests\")]\n    TooManyRequests,\n    #[error(\"HTTPInternalServerError\")]\n    HTTPInternalServerError,\n    #[error(\"UnexpectedNotModified\")]","sourceCodeStart":7,"sourceCodeEnd":43,"githubUrl":"https://github.com/oven-sh/bun/blob/8c5296ac459e8252d3cd702f3fbcbb0c249d95d5/src/install/error.rs#L7-L43","documentation":"The registry returned 403 Forbidden for the tarball request: authentication was accepted or irrelevant, but the identity is not permitted to fetch this artifact — insufficient token scopes, no grant on the private package, or an IP/policy block.","triggerScenarios":"Read-only or wrong-scope token used for a private org package; token user not granted access; corporate proxy/registry allowlist rejecting the CI runner's IP; granular token whose package list omits the dependency.","commonSituations":"CI token scoped to a different org; granular access tokens missing the package; self-hosted registries with IP rules; user removed from the team owning the package.","solutions":["Verify directly: curl -H \"Authorization: Bearer $TOKEN\" <tarball-url> and read the registry's error body","Grant the token's user read access to the package/org, or widen the token scope","For IP-blocked runners, add CI egress IPs to the registry allowlist","For granular tokens, include the package in the token's package list"],"exampleFix":"# before\n# granular token without @corp/private-pkg\nbun install   # -> TarballHTTP403\n\n# after\n# edit the token to include the package (or use an org token), then\nnpm whoami && bun install","handlingStrategy":"validation","validationCode":"const res = await fetch(\"https://registry.npmjs.org/@corp/private-pkg\", {\n  headers: { Authorization: `Bearer ${process.env.NPM_TOKEN}` },\n});\nif (res.status === 403 || res.status === 404) {\n  console.error(\"token lacks access to @corp/private-pkg\");\n  process.exit(1);\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Preflight private-package access in CI","Use org-scoped tokens with explicit package grants","Keep registry IP allowlists current for CI egress"],"tags":["install","network","auth","registry","http-403"],"backgroundTag":null,"analyzedSha":"8c5296ac459e8252d3cd702f3fbcbb0c249d95d5","analyzedAt":"2026-08-16T08:01:58.794Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}