[RRFC] turn off file name scrubbing for your own private registry

[claudiahdz]

Suggested in npm/cli#251

[haakemon]

So whats the discussion needed around this item? I was eagerly awaiting the linked PR, because scrubbing breaks audit run in certain cases f.ex as described here (https://npm.community/t/npm-audit-returns-400-from-registry-when-non-registry-packages-satisfy-specs-that-exist-in-the-registry/462 ), and honestly I dont really need any scrubbing features. I would prefer just a simple flag to turn it off globally.

[jweinsteincbt]

Related: npm/npm#20604

[darcyclarke]

@haakemon Appreciate the interest! This issue was created based on @isaacs' feedback here:

This should be a config value with docs and tests. I'd prefer not to bury ad hoc environment variable switches in the cli's command definitions, or it gets unmaintainable real fast.

Our hope is that we can move the discussion here to round out a more succinct implementation for something like --no-scrub.

I know @jweinsteincbt had some suggestions/questions that we can carry over as well:

Should this be limited to members of the org for that scope? Would need to cache the credentials so it does not need to do multiple lookups. Might not work for all registries (npm caching and so on). Also, that makes it harder to decide not to not require modules which have bad audit results if they are @ scoped.

We're definitely open to talking about this even at our Open RFC call today at 2:00pm ET if you'd like to jump on to flush out some of the details.

[haakemon]

Sorry, I did not have a chance to join the call.

What was the outcome of this? I read through the notes, but could not make out any decision (if any).

Thanks.

[IgorCreator]

Hey guys
The issue npm/npm#20604 have been archived already.

So I'll live comment here.
Next Solution might work:

Turning off npm audit on package installation
To turn off npm audit when installing a single package, use the --no-audit flag:

npm install example-package-name --no-audit

Installing all packages
To turn off npm audit when installing all packages, set the audit setting to false in your user and global .npmrc config files or:

npm set audit false