deps: upgrade npm to 6.1.0

PR-URL: https://github.com/nodejs/node/pull/20190
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
Reviewed-By: Tiancheng "Timothy" Gu <timothygu99@gmail.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>

1 files changed, 50 insertions, 32 deletions

diff --git a/deps/npm/node_modules/pacote/lib/fetchers/registry/tarball.js b/deps/npm/node_modules/pacote/lib/fetchers/registry/tarball.js
index 2c63872e7f..7239981279 100644
--- a/deps/npm/node_modules/pacote/lib/fetchers/registry/tarball.js
+++ b/deps/npm/node_modules/pacote/lib/fetchers/registry/tarball.js
@@ -7,22 +7,41 @@ const manifest = require('./manifest')
 const optCheck = require('../../util/opt-check')
 const PassThrough = require('stream').PassThrough
 const pickRegistry = require('./pick-registry')
-const pipe = BB.promisify(require('mississippi').pipe)
 const ssri = require('ssri')
 const url = require('url')
 
 module.exports = tarball
 function tarball (spec, opts) {
   opts = optCheck(opts)
+  const registry = pickRegistry(spec, opts)
   const stream = new PassThrough()
-  manifest(spec, opts).then(manifest => {
-    stream.emit('manifest', manifest)
-    return pipe(
-      fromManifest(manifest, spec, opts).on(
-        'integrity', i => stream.emit('integrity', i)
-      ),
-      stream
+  let mani
+  if (
+    opts.resolved &&
+    // spec.type === 'version' &&
+    opts.resolved.indexOf(registry) === 0
+  ) {
+    // fakeChild is a shortcut to avoid looking up a manifest!
+    mani = BB.resolve({
+      name: spec.name,
+      version: spec.fetchSpec,
+      _integrity: opts.integrity,
+      _resolved: opts.resolved,
+      _fakeChild: true
+    })
+  } else {
+    // We can't trust opts.resolved if it's going to a separate host.
+    mani = manifest(spec, opts)
+  }
+
+  mani.then(mani => {
+    !mani._fakeChild && stream.emit('manifest', mani)
+    const fetchStream = fromManifest(mani, spec, opts).on(
+      'integrity', i => stream.emit('integrity', i)
     )
+    fetchStream.on('error', err => stream.emit('error', err))
+    fetchStream.pipe(stream)
+    return null
   }).catch(err => stream.emit('error', err))
   return stream
 }
@@ -33,45 +52,44 @@ function fromManifest (manifest, spec, opts) {
   opts.scope = spec.scope || opts.scope
   const stream = new PassThrough()
   const registry = pickRegistry(spec, opts)
-  const uri = getTarballUrl(registry, manifest)
+  const uri = getTarballUrl(spec, registry, manifest, opts)
   fetch(uri, registry, Object.assign({
     headers: {
       'pacote-req-type': 'tarball',
-      'pacote-pkg-id': `registry:${
-        spec.type === 'remote'
-        ? spec
-        : `${manifest.name}@${manifest.version}`
-      }`
+      'pacote-pkg-id': `registry:${manifest.name}@${uri}`
     },
     integrity: manifest._integrity,
     algorithms: [
       manifest._integrity
-      ? ssri.parse(manifest._integrity).pickAlgorithm()
-      : 'sha1'
+        ? ssri.parse(manifest._integrity).pickAlgorithm()
+        : 'sha1'
     ],
     spec
-  }, opts)).then(res => {
-    const hash = res.headers.get('x-local-cache-hash')
-    if (hash) {
-      stream.emit('integrity', decodeURIComponent(hash))
-    }
-    res.body.on('error', err => stream.emit('error', err))
-    res.body.pipe(stream)
-  }).catch(err => stream.emit('error', err))
+  }, opts))
+    .then(res => {
+      const hash = res.headers.get('x-local-cache-hash')
+      if (hash) {
+        stream.emit('integrity', decodeURIComponent(hash))
+      }
+      res.body.on('error', err => stream.emit('error', err))
+      res.body.pipe(stream)
+      return null
+    })
+    .catch(err => stream.emit('error', err))
   return stream
 }
 
-function getTarballUrl (registry, manifest) {
+function getTarballUrl (spec, registry, mani, opts) {
+  const reg = url.parse(registry)
+  const tarball = url.parse(mani._resolved)
   // https://github.com/npm/npm/pull/9471
   //
-  // TL;DR: Some alternative registries host tarballs on http and packuments on
-  // https, and vice-versa. There's also a case where people who can't use SSL
-  // to access the npm registry, for example, might use
-  // `--registry=http://registry.npmjs.org/`. In this case, we need to rewrite
-  // `tarball` to match the protocol.
+  // TL;DR: Some alternative registries host tarballs on http and packuments
+  // on https, and vice-versa. There's also a case where people who can't use
+  // SSL to access the npm registry, for example, might use
+  // `--registry=http://registry.npmjs.org/`. In this case, we need to
+  // rewrite `tarball` to match the protocol.
   //
-  const reg = url.parse(registry)
-  const tarball = url.parse(manifest._resolved)
   if (reg.hostname === tarball.hostname && reg.protocol !== tarball.protocol) {
     tarball.protocol = reg.protocol
     // Ports might be same host different protocol!