theonedev/onedev · error · ClientException

Incorrect file name requested

Error message

Incorrect file name requested

What it means

Thrown when downloading an npm tarball via a two-segment path (<version>/<fileName>) and the requested file name does not match the file name recorded in the published package's NpmData. OneDev serves the tarball only under the exact name stored at publish time and rejects mismatches with HTTP 400.

Source

Thrown at server-plugin/server-plugin-pack-npm/src/main/java/io/onedev/server/plugin/pack/npm/NpmPackHandler.java:528

									} else {
										response.setStatus(SC_NOT_FOUND);
									}
								} else {
									response.setStatus(SC_NOT_FOUND);
								}
							});
						}
					} else {
						var version = decodePath(pathSegments.get(0));
						var fileName = decodePath(pathSegments.get(1));
						if (isGet) {
							sessionService.run(() -> {
								var project = checkProject(projectId, false);
								var pack = packService.findByNameAndVersion(project, TYPE, packageName, version);
								if (pack != null) {
									var packData = (NpmData) pack.getData();
									if (!packData.getFileName().equals(fileName)) 
										throw new ClientException(SC_BAD_REQUEST, "Incorrect file name requested");
									PackBlob packBlob;
									if ((packBlob = packBlobService.checkPackBlob(projectId, packData.getFileSha256BlobHash())) != null) {
										try {
											response.setContentType(MediaType.APPLICATION_OCTET_STREAM);
											packBlobService.downloadBlob(packBlob.getProject().getId(), packData.getFileSha256BlobHash(), response.getOutputStream());
											response.setStatus(SC_OK);
										} catch (IOException e) {
											throw new RuntimeException(e);
										}
									} else {
										response.setStatus(SC_NOT_FOUND);
									}
								} else {
									response.setStatus(SC_NOT_FOUND);
								}
							});
						} else if (isDelete) {
							LockUtils.run(getLockName(projectId, packageName), () -> {

View on GitHub (pinned to d44925c47c)

Solutions

1. Request the tarball with the exact file name stored at publish time (usually <packageName>-<version>.tgz).
2. Fetch the package metadata from OneDev and use the dist.tarball URL it returns instead of a hand-built URL.
3. If the package was published with a nonstandard tarball name, republish with the conventional name or adjust the client to use the stored name.

Example fix

// before
npm install my-pkg@1.0.0 --registry ...  (client builds my-pkg-1.0.tgz)
// after
use dist.tarball from registry metadata: /npm/proj/my-pkg/-/my-pkg-1.0.0.tgz

// Request the tarball only under the exact published file name
const expected = `${pkg.name.replace(/^@[^/]+\//, '')}-${pkg.version}.tgz`;
if (!tarballUrl.endsWith(expected)) console.warn(`Use ${expected} as the tarball file name`);

When it happens

Trigger: GET .../-/<version>/<fileName> where packData.getFileName() differs from the fileName path segment — e.g. requesting my-pkg-1.0.tgz when 1.0.0.tgz was published.

Common situations: npm client resolving a tarball URL from a stale or foreign registry metadata document; URL normalization shortening or altering the version in the filename; mirrored packages whose tarball names differ from OneDev's stored name.

Understand the failure class

Background: "Invalid query parameter" / "Failed to parse value of ...": fixing bad query string parameters across APIs — this error's family across 36 libraries.

Related errors

• Invalid request path
• File length incorrect:
• Integrity check failed:
• Unexpected integrity algorithm (file: %s, algorithm: %s)
• Missing version or file name

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/00b0f06885162000. Report an issue: GitHub.