pkglock: remove packageIntegrity field of doom

Author: zkat

lib/install/read-shrinkwrap.js

@@ -9,7 +9,6 @@ const log = require('npmlog')
 const parseJSON = require('../utils/parse-json.js')
 const path = require('path')
 const PKGLOCK_VERSION = require('../npm.js').lockfileVersion
-const pkgSri = require('../utils/package-integrity.js')
 
 const readFileAsync = BB.promisify(fs.readFile)
 
@@ -34,14 +33,6 @@ function readShrinkwrap (child, next) {
           throw ex
         }
       }
-      if (
-        pkgJson &&
-        parsed &&
-        parsed.packageIntegrity &&
-        !pkgSri.check(JSON.parse(pkgJson), parsed.packageIntegrity)
-      ) {
-        log.info('read-shrinkwrap', `${name} will be updated because package.json does not match what it was generated against.`)
-      }
       if (parsed && parsed.lockfileVersion !== PKGLOCK_VERSION) {
         log.warn('read-shrinkwrap', `This version of npm is compatible with lockfileVersion@${PKGLOCK_VERSION}, but ${name} was generated for lockfileVersion@${parsed.lockfileVersion || 0}. I'll try to do my best with it!`)
       }

lib/shrinkwrap.js

@@ -17,7 +17,6 @@ const moduleName = require('./utils/module-name.js')
 const move = require('move-concurrently')
 const npm = require('./npm.js')
 const path = require('path')
-const pkgSri = require('./utils/package-integrity.js')
 const readPackageTree = BB.promisify(require('read-package-tree'))
 const ssri = require('ssri')
 const validate = require('aproba')
@@ -184,7 +183,6 @@ function updateLockfileMetadata (pkginfo, pkgJson) {
   let metainfoWritten = false
   const metainfo = new Set([
     'lockfileVersion',
-    'packageIntegrity',
     'preserveSymlinks'
   ])
   Object.keys(pkginfo).forEach((k) => {
@@ -203,7 +201,6 @@ function updateLockfileMetadata (pkginfo, pkgJson) {
   }
   function writeMetainfo (pkginfo) {
     pkginfo.lockfileVersion = PKGLOCK_VERSION
-    pkginfo.packageIntegrity = pkgJson && pkgSri.hash(pkgJson)
     if (process.env.NODE_PRESERVE_SYMLINKS) {
       pkginfo.preserveSymlinks = process.env.NODE_PRESERVE_SYMLINKS
     }

lib/utils/package-integrity.js

@@ -7,7 +7,6 @@ const mr = require('npm-registry-mock')
 const npm = require('../../lib/npm.js')
 const osenv = require('osenv')
 const path = require('path')
-const pkgSri = require('../../lib/utils/package-integrity.js')
 const rimraf = require('rimraf')
 const test = require('tap').test
 
@@ -51,7 +50,6 @@ test('adds additional metadata fields from the pkglock spec', function (t) {
               'name': 'shrinkwrap-extra-metadata',
               'version': '0.0.0',
               'lockfileVersion': npm.lockfileVersion,
-              'packageIntegrity': pkgSri.hash(json),
               'preserveSymlinks': 'foo'
             },
             JSON.parse(desired),