Remove hostnames from the lockfiles

[arcanis]

We want to remove hostnames from the lockfiles:

wrappy@1:
  version "1.0.2"
  resolved "https://registry.yarnpkg.com/wrappy/-/wrappy-1.0.2.tgz#b5243d8f3ec1aa35f1364605bc0d1036e30ab69f"

Would become:

wrappy@1:
  version "1.0.2"
  resolved "/wrappy/-/wrappy-1.0.2.tgz#b5243d8f3ec1aa35f1364605bc0d1036e30ab69f"

This will allow us to switch the default registry more easily if we need to (for example if we want to deprecate our mirror, or if npm suddenly disappear from the surface of the earth), and will also make it easier for the users to switch from a registry to another.

[hutson]

@arcanis this idea is being tracked in the following RFC - yarnpkg/rfcs#64

[Daniel15]

What about custom registries/repositories? If a project has a mix of different registries (eg. some from regular public npm, some from a private internal server), how would it know which is which? Particularly since there could be overlap in package names.

[arcanis]

@Daniel15 I think in this case it is recommended to keep the packages coming from a private internal server behind a specific scope, so that you can use scope-specific registry urls.

[dballance]

Adding a datapoint here for @arcanis.

At least for VSTS/TFS, this pattern seems to work.

My yarn.lock matches the pattern for upstream packages:

typescript@~2.8.3:
  version "2.8.3"
  resolved "<INTERNAL_REGISTRY>/typescript/-/typescript-2.8.3.tgz#5d817f9b6f31bb871835f4edf0089f21abe6c170"

Be sure to keep scoped packages in mind - there is an extra segment:

"@types/estree@0.0.38":
  version "0.0.38"
  resolved "<INTERNAL_REGISTRY>/@types/estree/-/estree-0.0.38.tgz#c1be40aa933723c608820a99a373a16d215a1ca2"

[liamjones]

Looks like it'd work for Nexus Repository too - you have a repo section after the server root but the tail of the URL is still the same:

type-check@~0.3.2:
  version "0.3.2"
  resolved "https://<server>/repository/<repo-identifier>/type-check/-/type-check-0.3.2.tgz#5884cab512cf1d355e3fb784f30804b2b520db72"
  dependencies:
    prelude-ls "~1.1.2"

[besh]

Confirming that it looks like it would work for artifactory too.

https://<country>.artifactory.<company>.com/artifactory/api/npm/<repo>/<module>.tgz

[juanpicado]

Verdaccio follows the same tarball url pattern as main registry using the default configuration, unless a user decides to use a prefix for reverse proxy.

https://<domain:port>/<prefix?>/-/<module>/<module>.tgz

Examples from yarn.lock.

resolved "http://localhost:4873/md5.js/-/md5.js-1.3.4.tgz#e9bdbde94a20a5ac18b04340fc5764d5b09d901d"
# scoped
resolved "http://localhost:4873/@babel%2fparser/-/parser-7.0.0-beta.51.tgz#27cec2df409df60af58270ed8f6aa55409ea86f6"

[arcanis]

Unfortunately we discovered that some registries follow entirely different rules (a surprising one being ... NPM Enterprise ...), so we won't be able to just trim the hostname 😞

Maybe we'll end up having a whitelist of domain names that can work this way ... but it's annoying.

[swojit]

What are their rules?

[arcanis]

Currently, it's something similar to this (cf pnpm/pnpm#867):

https://npm-registry.compass.com/p/pnpm/_attachments/pnpm-1.9.0.tgz

No idea why they chose to break their convention.