npm / arborist / #1080 / 1

push

fix: pass integrity to pacote.extract

when crackOpen becomes true we were extracting the content through
pacote without providing an integrity, because of this pacote was
creating its own internal ssri IntegrityStream that uses the default
algorithm and piping the response data through that for reasons.
when the default algorithm differs from the current one, which is
often the case with older packages that had sha1 digests, we were
throwing an EINTEGRITY error attempting to compare the old and
correct sha1 to a new and unknown sha512 (the default). by passing
the node's current integrity value we ensure that pacote compares
the sha1 to a sha1 which works as expected.

3069 of 3069 branches covered (100.0%)

Branch coverage included in aggregate %.

4159 of 4159 relevant lines covered (100.0%)

565.5 hits per line