[RRFC] Only use registry provided URLs to fetch tarballs

Motivation ("The Why")

npm 7 introduced a change where it computes tarball URLs from the registry name instead of using the URL provided by the registry. This causes third party registries that don't host their own tarballs to fail.

How

Current Behaviour

Tarball URLs are rewritten to one's that are not guaranteed to match the one's that are registry provided nor in the lockfile. This amounted to a substantial change to the npm protocol.

Desired Behaviour

This seems to have been implemented so that when you change your default registry, npm would download tarballs from the new registry regardless of the lockfile. This is clearly desirable behavior, but the assumptions about how third party registries store their tarballs are not always correct.

I would propose that:

A) The registry config in use when a lock-file is generated should be recorded to the lockfile.
B) When the currently configured registr(y|ies) changes (determined by comparing config to lockfile), npm will refresh tarball URLs by querying metadata from the new registry. This would allow for the new npm7 functionality without breaking third party registries that don't host their tarballs the same way that npmjs.org does.

Open Questions

• When npm finds a registry change or new tarball URLs should it update the lockfile?
  • Naively, the answer feels like yes, but my impression is that the core use case of this feature is for environments where the same lockfile is used both in public environments (with npmjs.org) and private one's (with a private registry). If so, updating the lockfile every time would not be desirable.ee

References

• Details and a reproduction of the behavior are available in bug report #3530.

Start with the linked behavior report in #3530 and its reproduction repository to understand npm 7's tarball URL rewriting. Then resolve how registry configuration and refreshed tarball URLs should be represented in the lockfile; done requires an agreed approach to the open questions before implementation can be scoped.