Upstream packuments may omit dist.integrity, leaving pnpm clients unable to
install those versions through pnpr.
When pnpr fetches a packument from a caching upstream, it downloads each
version that lacks a usable integrity (capped at 64 per fetch), verifies a
declared legacy shasum, caches the tarball, and persists the computed SHA-512
into the cached packument. Resolution and later tarball requests then use the
same integrity.
Pinning is per version: a version that cannot be downloaded, fails its
shasum, or has a malformed dist keeps its upstream metadata and is refused by
the tarball route, while the rest of the package stays installable. Pinning
runs only on an upstream fetch, not on cached reads, so unpinnable versions
cost one request per refresh. The downloads run without the striped package
lock, which hosted publishes share. Each tarball is synced and closed but
not promoted. Under the lock, pnpr re-reads the cached packument, writes a
pin only where that version still declares the same tarball and shasum
without a usable integrity, persists the packument, and only then renames
those tarballs into the cache; the rest are abandoned. A refresh that lands
meanwhile is kept, a published pin always describes the cached bytes, and
a cached tarball never lacks its published pin. If the packument write
fails, the staged tarballs are abandoned and the unpinned packument is
served. Packument refreshes and authoritative-404 purges take the same lock
for their cache writes, and pinning publishes nothing when the cached
packument is gone. Cache-disabled
upstreams are left unchanged because the computed pin cannot be stored.
Related to pnpm/tasks#24
---------
Co-authored-by: Zoltan Kochan <z@kochan.io>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
