oven-sh/bun · error · bun_install::Error

TarballHTTP403

Error message

TarballHTTP403

What it means

The registry returned 403 Forbidden for the tarball request: authentication was accepted or irrelevant, but the identity is not permitted to fetch this artifact — insufficient token scopes, no grant on the private package, or an IP/policy block.

Source

Thrown at src/install/error.rs:25

    #[error("NotDir")]
    NotDir,
    #[error("NameTooLong")]
    NameTooLong,
    #[error("SymLinkLoop")]
    SymLinkLoop,
    #[error("SystemFdQuotaExceeded")]
    SystemFdQuotaExceeded,
    #[error("SystemResources")]
    SystemResources,
    #[error("DeviceBusy")]
    DeviceBusy,
    #[error("TarballHTTP400")]
    TarballHTTP400,
    #[error("TarballHTTP401")]
    TarballHTTP401,
    #[error("TarballHTTP402")]
    TarballHTTP402,
    #[error("TarballHTTP403")]
    TarballHTTP403,
    #[error("TarballHTTP404")]
    TarballHTTP404,
    #[error("TarballHTTP4xx")]
    TarballHTTP4xx,
    #[error("TarballHTTP5xx")]
    TarballHTTP5xx,
    #[error("TarballFailedToExtract")]
    TarballFailedToExtract,
    #[error("TarballFailedToDownload")]
    TarballFailedToDownload,
    #[error("BadRequest")]
    BadRequest,
    #[error("TooManyRequests")]
    TooManyRequests,
    #[error("HTTPInternalServerError")]
    HTTPInternalServerError,
    #[error("UnexpectedNotModified")]

View on GitHub (pinned to 8c5296ac45)

Solutions

1. Verify directly: curl -H "Authorization: Bearer $TOKEN" <tarball-url> and read the registry's error body
2. Grant the token's user read access to the package/org, or widen the token scope
3. For IP-blocked runners, add CI egress IPs to the registry allowlist
4. For granular tokens, include the package in the token's package list

Example fix

# before
# granular token without @corp/private-pkg
bun install   # -> TarballHTTP403

# after
# edit the token to include the package (or use an org token), then
npm whoami && bun install

const res = await fetch("https://registry.npmjs.org/@corp/private-pkg", {
  headers: { Authorization: `Bearer ${process.env.NPM_TOKEN}` },
});
if (res.status === 403 || res.status === 404) {
  console.error("token lacks access to @corp/private-pkg");
  process.exit(1);
}

When it happens

Trigger: Read-only or wrong-scope token used for a private org package; token user not granted access; corporate proxy/registry allowlist rejecting the CI runner's IP; granular token whose package list omits the dependency.

Common situations: CI token scoped to a different org; granular access tokens missing the package; self-hosted registries with IP rules; user removed from the team owning the package.

Related errors

• TarballHTTP401
• not called
• TarballHTTP402
• TarballHTTP404
• page-cache eviction failed for ${path}; results would be war

AI-assisted analysis of oven-sh/bun@8c5296ac45 (2026-08-16). Data as JSON: /api/errors/61c693e6759c7b30. Report an issue: GitHub.