<p dir="auto"><strong>Update</strong>: This issue explained in my comment seems to have been fixed in v7.11.0 (see <a href="https://github.com/npm/cli/issues/2971#issuecomment-1035156508" data-hovercard-type="issue" data-hovercard-url="/npm/cli/issues/2971/hovercard">my update comment</a>), however, another user has <a href="https://github.com/npm/cli/issues/2971#issuecomment-891422616" data-hovercard-type="issue" data-hovercard-url="/npm/cli/issues/2971/hovercard">described a similar error</a> in v7.20.3, so I'm unsure whether I should close this issue or leave it open.</p>
<p dir="auto"><strong>Using a git URL in the format <code class="notranslate">github:geotiffjs/geotiff.js#commit-hash</code> on NPM v7 fails with sha-512 integrity errors. However, using a branch-name/tag pointing to the same commit works fine.</strong></p>
<p dir="auto">I can't seem to find another Git repo where this is failing (except for forks of geotiff.js), so I think the issue might either with Github repos with periods in their name and/or with <code class="notranslate">package.json</code> <code class="notranslate">prepare</code> scripts.</p>
<p dir="auto">This might be related to <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="838432980" data-permission-text="Title is private" data-url="https://github.com/npm/cli/issues/2919" data-hovercard-type="issue" data-hovercard-url="/npm/cli/issues/2919/hovercard" href="https://github.com/npm/cli/issues/2919">#2919</a> which has a similar title, but their logs and behaviour are different.<br>
I'm fairly certain this is an issue with the CDN, since it doesn't happen in Node v6, and if I use a <code class="notranslate">get+ssh</code> URL on a new VM, the code fails before I get a pop-up with a <code class="notranslate">The authenticity of host 'github.com (140.82.121.3)' can't be established.</code></p>
<h3 dir="auto">Current Behavior:</h3>
<p dir="auto">For the <a href="https://github.com/geotiff/geotiff.js">geotiff/geotiff.js</a> repo, using a <code class="notranslate">git+https://...#commit-hash</code> URL fails with a <code class="notranslate">EINTEGRITY</code> error, due to the sha512 error, e.g.</p>
<div class="highlight highlight-text-shell-session notranslate position-relative overflow-auto" dir="auto" data-snippet-clipboard-copy-content="ubuntu@gittest:~/geotiff.js$ npm pack &quot;git+https://github.com/geotiffjs/geotiff.js.git#c01b2dcf00d5a324cd27c38709cb6ca97adf01e2&quot;
npm WARN tarball tarball data for git+ssh://git@github.com/geotiffjs/geotiff.js.git#c01b2dcf00d5a324cd27c38709cb6ca97adf01e2 (sha512-NdxkcAm6FPXBKyhAHuYp0yMyKcBboXzf00h9hqo+yAVhAPVk6d68GH11SV9n4v2OZ9Roe1zQfCzV4TuoeskVLw==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for git+ssh://git@github.com/geotiffjs/geotiff.js.git#c01b2dcf00d5a324cd27c38709cb6ca97adf01e2 (sha512-NdxkcAm6FPXBKyhAHuYp0yMyKcBboXzf00h9hqo+yAVhAPVk6d68GH11SV9n4v2OZ9Roe1zQfCzV4TuoeskVLw==) seems to be corrupted. Trying again.
npm ERR! code EINTEGRITY
npm ERR! sha512-NdxkcAm6FPXBKyhAHuYp0yMyKcBboXzf00h9hqo+yAVhAPVk6d68GH11SV9n4v2OZ9Roe1zQfCzV4TuoeskVLw== integrity checksum failed when using sha512: wanted sha512-NdxkcAm6FPXBKyhAHuYp0yMyKcBboXzf00h9hqo+yAVhAPVk6d68GH11SV9n4v2OZ9Roe1zQfCzV4TuoeskVLw== but got sha512-c2I+9X+wgzfOMS8/Fn09R8BjPrjEavxj0r39aO/loMvtWlA6BNxAlatfcnW8WHhOfgbEbIRi9k3WNpJh2yoxKQ==. (709406 bytes)

npm ERR! A complete log of this run can be found in:
npm ERR!     /home/ubuntu/.npm/_logs/2021-03-26T14_59_04_649Z-debug.log"><pre class="notranslate"><span class="pl-e">ubuntu@gittest:~/geotiff.js</span>$ <span class="pl-s1">npm pack <span class="pl-s"><span class="pl-pds">"</span>git+https://github.com/geotiffjs/geotiff.js.git#c01b2dcf00d5a324cd27c38709cb6ca97adf01e2<span class="pl-pds">"</span></span></span>
<span class="pl-c1">npm WARN tarball tarball data for git+ssh://git@github.com/geotiffjs/geotiff.js.git#c01b2dcf00d5a324cd27c38709cb6ca97adf01e2 (sha512-NdxkcAm6FPXBKyhAHuYp0yMyKcBboXzf00h9hqo+yAVhAPVk6d68GH11SV9n4v2OZ9Roe1zQfCzV4TuoeskVLw==) seems to be corrupted. Trying again.</span>
<span class="pl-c1">npm WARN tarball tarball data for git+ssh://git@github.com/geotiffjs/geotiff.js.git#c01b2dcf00d5a324cd27c38709cb6ca97adf01e2 (sha512-NdxkcAm6FPXBKyhAHuYp0yMyKcBboXzf00h9hqo+yAVhAPVk6d68GH11SV9n4v2OZ9Roe1zQfCzV4TuoeskVLw==) seems to be corrupted. Trying again.</span>
<span class="pl-c1">npm ERR! code EINTEGRITY</span>
<span class="pl-c1">npm ERR! sha512-NdxkcAm6FPXBKyhAHuYp0yMyKcBboXzf00h9hqo+yAVhAPVk6d68GH11SV9n4v2OZ9Roe1zQfCzV4TuoeskVLw== integrity checksum failed when using sha512: wanted sha512-NdxkcAm6FPXBKyhAHuYp0yMyKcBboXzf00h9hqo+yAVhAPVk6d68GH11SV9n4v2OZ9Roe1zQfCzV4TuoeskVLw== but got sha512-c2I+9X+wgzfOMS8/Fn09R8BjPrjEavxj0r39aO/loMvtWlA6BNxAlatfcnW8WHhOfgbEbIRi9k3WNpJh2yoxKQ==. (709406 bytes)</span>

<span class="pl-c1">npm ERR! A complete log of this run can be found in:</span>
<span class="pl-c1">npm ERR!     /home/ubuntu/.npm/_logs/2021-03-26T14_59_04_649Z-debug.log</span></pre></div>
<p dir="auto">Attached logfile: <a href="https://github.com/npm/cli/files/6212631/2021-03-26T14_59_04_649Z-debug.log">2021-03-26T14_59_04_649Z-debug.log</a></p>
<p dir="auto">The same error occurs if you try to do <code class="notranslate">npm install</code> on the URL, or if you use a <code class="notranslate">git+ssh</code> url, or a short <code class="notranslate">github:</code> url:  <code class="notranslate">github:geotiffjs/geotiff.js#c01b2dcf00d5a324cd27c38709cb6ca97adf01e2</code></p>
<h3 dir="auto">Expected Behavior:</h3>
<p dir="auto">Using NPM v6.14.11, the exact same command works fine.</p>
<div class="highlight highlight-text-shell-session notranslate position-relative overflow-auto" dir="auto" data-snippet-clipboard-copy-content="# ON NPM v6
ubuntu@gittest:~/geotiff.js$ npm pack &quot;git+https://github.com/geotiffjs/geotiff.js.git#c01b2dcf00d5a324cd27c38709cb6ca97adf01e2&quot;
npm notice 
npm notice 📦  geotiff@1.0.0
npm notice === Tarball Contents === 
npm notice 1.1kB   LICENSE
# ...etc"><pre class="notranslate"># <span class="pl-s1">ON NPM v6</span>
<span class="pl-e">ubuntu@gittest:~/geotiff.js</span>$ <span class="pl-s1">npm pack <span class="pl-s"><span class="pl-pds">"</span>git+https://github.com/geotiffjs/geotiff.js.git#c01b2dcf00d5a324cd27c38709cb6ca97adf01e2<span class="pl-pds">"</span></span></span>
<span class="pl-c1">npm notice </span>
<span class="pl-c1">npm notice 📦  geotiff@1.0.0</span>
<span class="pl-c1">npm notice === Tarball Contents === </span>
<span class="pl-c1">npm notice 1.1kB   LICENSE</span>
# <span class="pl-s1">...etc</span></pre></div>
<p dir="auto">Additionally, even on NPM v7.7.5, using a branch/tag name works fine: e.g.<code class="notranslate">npm pack "github:github.com/geotiffjs/geotiff.js.git#v1.0.0"</code> works on NPMv7, even though tag <code class="notranslate">v1.0.0</code> points to the same commit.</p>
<h3 dir="auto">Steps To Reproduce:</h3>
<p dir="auto">On NPM v7.7.5, run the following command:</p>
<p dir="auto"><code class="notranslate">npm pack "git+https://github.com/geotiffjs/geotiff.js.git#c01b2dcf00d5a324cd27c38709cb6ca97adf01e2"</code></p>
<p dir="auto">You can also try spinning up an Ubuntu VM using <code class="notranslate">minipool</code>:</p>
<ul dir="auto">
<li><code class="notranslate">multipass launch --name npm-git-test &amp;&amp; multipass shell npm-git-test</code></li>
<li>install NVM then restart shell <code class="notranslate">curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.37.2/install.sh | bash</code></li>
<li>Try working cmd on NPM v6.14.11: <code class="notranslate">npm pack github:geotiffjs/geotiff.js#c01b2dcf00d5a324cd27c38709cb6ca97adf01e2</code></li>
<li>Update to NPM v7.7.5 and see the same command fail: <code class="notranslate">npm install -g npm &amp;&amp; npm pack github:geotiffjs/geotiff.js#c01b2dcf00d5a324cd27c38709cb6ca97adf01e2</code></li>
</ul>
<h3 dir="auto">Environment:</h3>
<p dir="auto">I've tested this on a VM running:</p>
<ul dir="auto">
<li>OS: Ubuntu 20.04.2 LTS</li>
<li>Node: v14.16.0</li>
<li>npm: 7.7.5</li>
</ul>
<p dir="auto">and a desktop running:</p>
<ul dir="auto">
<li>OS: Ubuntu 20.04.2 LTS</li>
<li>Node: v12.19.1</li>
<li>npm: 7.7.5</li>
</ul>
<h3 dir="auto">Current Behavior:</h3>

<p dir="auto">The <code class="notranslate">package-lock.json</code> integrity value seems to depend on the OS/architecture. Take the following git dependency which specifies a commit hash:</p>
<div class="highlight highlight-source-js notranslate position-relative overflow-auto" dir="auto" data-snippet-clipboard-copy-content="npm pack &quot;git+ssh://git@github.com/jhiesey/idb-kv-store.git#109ccad165fd6470e12fd66025da9e4743a46043&quot;"><pre class="notranslate"><span class="pl-s1">npm</span> <span class="pl-s1">pack</span> <span class="pl-s">"git+ssh://git@github.com/jhiesey/idb-kv-store.git#109ccad165fd6470e12fd66025da9e4743a46043"</span></pre></div>
<p dir="auto">The integrity value produced is different on these OSes/architectures:</p>
<ul dir="auto">
<li>Ubuntu 20.04, and macOS 11.2.3 (Intel): <code class="notranslate">sha512-DnBTbDDxd9/9mwPehyraeuRTbNEqbWLcAdE3GC1trdBWWwKnkWsaU/X6mVLIKKB/IYWmG+cnL3ihg/Ql/rW5kg==</code></li>
<li>macOS 11.2.3 (Apple Silicon): <code class="notranslate">sha512-T3ZWOM1TT+Ch/splApkEe1HwktWs+n/iHvDvtIGEI+4xuMGHite6mMujuNd8sen49ofLP/PxzprQMSPJK8APww==</code></li>
</ul>
<h3 dir="auto">Expected Behavior:</h3>

<p dir="auto">The integrity value should not be different on Apple Silicon (M1 chip) machines.</p>
<h3 dir="auto">Steps To Reproduce:</h3>
<p dir="auto">Run <code class="notranslate">npm pack "git+ssh://git@github.com/jhiesey/idb-kv-store.git#109ccad165fd6470e12fd66025da9e4743a46043" </code> and inspect the integrity value from an M1 Mac. Node.js was installed from Homebrew using <code class="notranslate">brew install node</code> and the <code class="notranslate">amd64</code> version was installed.</p>
<p dir="auto">Also... <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/jhiesey/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/jhiesey">@jhiesey</a> and I dug into this a bit and found that the tarballs fetched from the GitHub CDN are exactly the same on M1 and other architectures, byte-for-byte. Same for the ungzipped tarballs – they are the same byte-for-byte. What differs, though, is the gzipped tarballs (<code class="notranslate">.tar.gz</code>) files. Those appear to have substantial differences when viewed in a hex editor.</p>
<h3 dir="auto">Environment:</h3>
<ul dir="auto">
<li>OS: Various, see above</li>
<li>Node: v15.11.0</li>
<li>npm: 7.6.2</li>
</ul>