Critical bug? ERR_PNPM_FETCH_404 because /download/ is /-/ for new packages on npmjs

[AgainPsychoX]

pnpm version: pnpm@6.14.5

Code to reproduce the issue

Wanted to contribute to https://github.com/liuweiGL/vite-plugin-mkcert/ , freshly cloned, try to run npm install, notice it's pnpm repo (thanks for npx only-allow pnpm), installed freshly pnpm globally, tried running pnpm install, it was running for a while, then I see multiple warnings and error at the end.

Debug log: https://gist.github.com/AgainPsychoX/dd85dbc4490fe9137ef14ba1d787f075

Expected behaviour

Download all packages successfully.

Actual behaviour

Additional information

Node version: v16.3.0
Operating system: Windows 10

After some investigation, I realized that PNPM is wrong here and it seems ignoring NPMJS registry manifests...

For example:

• https://registry.npmjs.org/has-unicode/download/has-unicode-2.0.1.tgz is 404.
• https://registry.npmjs.org/has-unicode/ tells us version 2.0.1 exists, but under different URL.
• https://registry.npmjs.org/has-unicode/-/has-unicode-2.0.1.tgz downloads successfully and it's valid package.

IMO, the registry should rewrite /download/ to /-/ "just in case", but for sure the PNPM should look up manifests URL for downloading.

[zkochan]

This happened because the lockfile was created using a non-standard registry. So the one who created the lockfile, was using

registry=https://registry.npm.taobao.org/

https://github.com/liuweiGL/vite-plugin-mkcert/blob/4ddd0f145535ace5a79af2ddf7f6e56f057c4e2d/.npmrc#L2

For some reason, taobao uses different location for the tarballs. I am not sure how could we fix it. Maybe using some hardcoded fix. If the tarball contains /download/ and the registry is npmjs, we can try the standard tarball URL

[richex-cn]

Any updates? I also encountered this mistake while pnpm i, Is it possible to consider adding a command line parameter to make pnpm ignore the tarball in lockfile?

[banyudu]

I bypassed this issue by running npm config set registry https://registry.npm.taobao.org/

[richex-cn]

I bypassed this issue by running npm config set registry https://registry.npm.taobao.org/

If you use a non-standard registry to generate a lock file, there will be annoying problems when you want to use the NPM registry in future.

BTW, Taobao registry mirror has been changed to https://registry.npmmirror.com , And the resolution of npm.taobao.org will stop on 2022-06-16.