[BUG] Integrity check fails for azure artifacts (and apparently other private registries) NPM packages

[PaulVrugt]

Current Behavior:

We are trying to upgrate to NPM 7, but we run into problems with getting packages from azure artifacts. The following log is shown, when running npm i --verbose:

npm WARN tarball tarball data for https://infolandcode.pkgs.visualstudio.com/_packaging/Shared/npm/registry/xxx/xxx.tgz (sha1-ZTIGEke6SQtyObZXul6THKgWSz0=) seems to be corrupted. Trying again.
npm WARN tarball tarball data for https://infolandcode.pkgs.visualstudio.com/_packaging/Shared/npm/registry/xxx/xxx.tgz (sha1-oYbrH56D5xdd2LzPKGiYWv/1Z9w=) seems to be corrupted. Trying again.
npm WARN tarball tarball data for https://infolandcode.pkgs.visualstudio.com/_packaging/Shared/npm/registry/xxx/xxx.tgz (sha1-ZTIGEke6SQtyObZXul6THKgWSz0=) seems to be corrupted. Trying again.
npm WARN tarball tarball data for https://infolandcode.pkgs.visualstudio.com/_packaging/Shared/npm/registry/xxx/xxx.tgz (sha1-oYbrH56D5xdd2LzPKGiYWv/1Z9w=) seems to be corrupted. Trying again.
npm timing reify:rollback:createSparse Completed in 2ms
npm timing reify:rollback:retireShallow Completed in 1ms
npm timing command:install Completed in 1784ms
npm verb stack Error: sha1-ZTIGEke6SQtyObZXul6THKgWSz0= integrity checksum failed when using sha1: wanted sha1-ZTIGEke6SQtyObZXul6THKgWSz0= but got sha512-1HAETTUJsxZ0ZT/s/kYXiDJgmm4bXD7co77wzewb4t8BBW7Vhk0ONkOs5orSToPCtu41U30n/e50gqTgia8anA== sha1-oCrDJJcm5EvGPkto9uzdg5hsPC0=. (307 bytes)

Expected Behavior:

I expect the packages to be downloaded correctly, just as they did using npm 6

Steps To Reproduce:

Reference packages to azure artifacts in your package.json. Try to run npm install

expected:
packages install

actual:
error as shown above

Environment:

• OS: windows 10
• Node: v12.16.1
• npm: 7@beta10

[leandro-manifesto]

I'm also getting this with Gemfury's private registry, but the signature is a SHA512 in my case.

Both NPM 6.14.6 and Yarn 1.22.5 work properly, but NPM 7.0.0-beta.10 is calculating a different signature and failing the integrity check.

[ValeryVS]

Also getting such error with private registry and npm@7.0.0-beta.12.
Install with npm@6.14.6, npm@6.14.8 and yarn@1.22.4 works properly.

[jayphelps]

Also getting this with a custom package installed from the github npm registry https://npm.pkg.github.com. Hopefully this is helpful correlation that it seems to be non-npm official registry related. Downgrading from 7.0.0-beta.12 to v6 worked.

integrity checksum failed when using sha512:
wanted sha512-X99IsgB5ElySriQwf/O4bimqNVHS9Wwij3KZLURUkC3dxO/028WcbiQRO2NtE2YJQgLkoFl8evwf0sR8jmxRFQ==
but got sha512-z4PhNX7vuL3xVChQ1m2AB9Yg5AULVxXcg/SpIdNs6c5H0NE8XYXysP+DGNKHfuwvY7kxvUdBeoGlODJ6+SfaPg==

Since this is a private package, I'm happy to do a Zoom with any team member and give them access if they are unable to reproduce independently.

[PaulVrugt]

@jayphelps
I've tested downgrading to 7.0.0-beta.6 but this didn't help for me. The same issue:

npm ERR! sha1-ZTIGEke6SQtyObZXul6THKgWSz0= integrity checksum failed when using sha1: 
wanted sha1-ZTIGEke6SQtyObZXul6THKgWSz0= 
but got sha512-1HAETTUJsxZ0ZT/s/kYXiDJgmm4bXD7co77wzewb4t8BBW7Vhk0ONkOs5orSToPCtu41U30n/e50gqTgia8anA== sha1-oCrDJJcm5EvGPkto9uzdg5hsPC0=.

[jayphelps]

@PaulVrugt sorry, I meant v6.x.x, the current stable release, not a beta for v7

[darcyclarke]

We've potentially got a fix for this based on some work @nlf is about to land in a point release. I'll let him follow up though to confirm once we've got that out to have you try to reproduce.