package@version exemptions for --validate-integrity about lockfile-lint HOT 6 CLOSED

I published a package that replaces sha1 with sha512. Check it out. I use it as a postinstall script. Currently, it supports only npm

This is great, with a few changes I can adapt this to work with private npm registries.
edit: And here we are - yoavain/fix-lockfile-integrity#167

@yoavain worked on something similar, maybe he could chime in (and yes, we'd appreciate a PR if this is in-line with expected functionality, thank you for suggesting!)

After having a look at the above package, what I observed earlier may be a bug in the private registry implementation I am using. So perhaps not inline with expected functionality - maybe best to wait and see if there is demand for it?

from lockfile-lint.

@yoavain worked on something similar, maybe he could chime in (and yes, we'd appreciate a PR if this is in-line with expected functionality, thank you for suggesting!)

from lockfile-lint.

I published a package that replaces sha1 with sha512.
Check it out.
I use it as a postinstall script.
Currently, it supports only npm
You can try it out:

npx fix-lockfile-integrity

You can read about CLI flags and configuration here:
https://www.npmjs.com/package/fix-lockfile-integrity

from lockfile-lint.

I published a package that replaces sha1 with sha512. Check it out. I use it as a postinstall script. Currently, it supports only npm

This is great, with a few changes I can adapt this to work with private npm registries. edit: And here we are - yoavain/fix-lockfile-integrity#167

@yoavain worked on something similar, maybe he could chime in (and yes, we'd appreciate a PR if this is in-line with expected functionality, thank you for suggesting!)

After having a look at the above package, what I observed earlier may be a bug in the private registry implementation I am using. So perhaps not inline with expected functionality - maybe best to wait and see if there is demand for it?

Right, that's why I explicitly handle only registry.npmjs.org.
Had issues with Jfrog Artifactory which always return SHA1

from lockfile-lint.

Had issues with Jfrog Artifactory which always return SHA1

In my case, it looks like a very old internal/scoped packaged which Artifactory has not migrated correctly during an upgrade - so it has no sha512.

from lockfile-lint.

Thanks for the conversation @kusalk and @yoavain for moderating 🤗

from lockfile-lint.