disable generating of tarball on lockfiles

[sibelius]

'@adobe/[email protected]':

• resolution: {integrity: sha512-Elp+iwUx5rN5+Y8xLt5/GRoG20WGoDCQ/1Fb+1LiGtvwbDavuSk0jhD/eZdckHAuzcDzccnkv+rEjyWfRx18gg==, tarball: http://10.99.40.1:16443/@adobe/css-tools/-/css-tools-4.4.4.tgz}

• resolution: {integrity: sha512-Elp+iwUx5rN5+Y8xLt5/GRoG20WGoDCQ/1Fb+1LiGtvwbDavuSk0jhD/eZdckHAuzcDzccnkv+rEjyWfRx18gg==}

I don't want the tarball: http://10.99.40.1:16443/@adobe/css-tools/-/css-tools-4.4.4.tgz

in my lockfile

[zkochan]

This happens when the tarball is hosted not under the registry domain.

[sibelius]

we are using verdaccio to avoid hitting npm registry

is there a way to remove it from the tarball so we can hit npm registry back when the verdaccio is not up ?

[zkochan]

The domain in the metadata URL, e.g.: https://registry.npmjs.org/is-odd

should match the domain in the tarball URL. For instance: https://registry.npmjs.org/is-odd/-/is-odd-0.1.0.tgz

In that case the URL for the tarball will not be included in the lockfile. If not, we must include it because there's no way to automatically calculate it.