feat: prefer SHA2 in shrinkwrap.yaml

src/resolve/npm/index.ts

@@ -51,7 +51,7 @@ export default async function resolveNpm (spec: PackageSpec, opts: ResolveOption
     const resolution: TarballResolution = {
       tarball: correctPkg.dist.tarball,
       registry: opts.registry,
-      integrity: ssri.fromHex(correctPkg.dist.shasum, 'sha1').toString(),
+      integrity: getIntegrity(correctPkg.dist),
     }
     return {id, resolution, package: correctPkg}
   } catch (err) {
@@ -62,6 +62,17 @@ export default async function resolveNpm (spec: PackageSpec, opts: ResolveOption
   }
 }
 
+function getIntegrity (dist: {
+  integrity?: string,
+  shasum: string,
+  tarball: string,
+}) {
+  if (dist.integrity) {
+    return dist.integrity
+  }
+  return ssri.fromHex(dist.shasum, 'sha1').toString()
+}
+
 function pickVersion (meta: PackageMeta, dep: PackageSpec) {
   if (dep.type === 'tag') {
     return pickVersionByTag(meta, dep.fetchSpec)

src/resolve/npm/loadPackageMeta.ts

@@ -20,6 +20,7 @@ export type PackageMeta = {
 
 export type PackageInRegistry = Package & {
   dist: {
+    integrity?: string,
     shasum: string,
     tarball: string
   }

test/shrinkwrap.ts

@@ -382,7 +382,7 @@ test('scoped module from different registry', async function (t: tape.Test) {
       },
       'registry.npmjs.org/@zkochan/foo/1.0.0': {
         resolution: {
-          integrity: 'sha1-hJws2Ke4u4ghPFL/+6eqlSrgLLI=',
+          integrity: 'sha512-IFvrYpq7E6BqKex7A7czIFnFncPiUVdhSzGhAOWpp8RlkXns4y/9ZdynxaA/e0VkihRxQkihE2pTyvxjfe/wBg==',
           registry: 'https://registry.npmjs.org/',
           tarball: 'https://registry.npmjs.org/@zkochan/foo/-/foo-1.0.0.tgz'
         }