For CI runs, Yarn should have a way to show what registry each package was pulled from

[BrianMcBrayer]

Hello,

I love yarn! It's great.

I would like some help getting Yarn (berry, v.3) to show the full resolution URL for each package that it pulls. My project needs provenance information, and I have to imagine that there's some setting that will show this (and if it can add it to the lockfile that would be even better!). I've tried all the settings that I can think of in the yarn yaml file and no luck.

Thanks!

[paul-soporan]

and if it can add it to the lockfile that would be even better!

Yarn Classic used to add it to the lockfile, but in Modern we've intentionally changed this so that it doesn't have to update the lockfile each time the registry is swapped if it uses a conventional URL format.

Because of this, the registry to use is only computed based on the configuration. You can use the yarn npm info command to see where Yarn fetches the package metadata from (which includes the tarball URL):

yarn npm info @yarnpkg/core --json | jq .dist.tarball

(You can optionally specify a version for the package)

(This just made me realize that there are a few improvements we could do to the yarn npm info command, such as being able to access nested fields without additional helpers such as jq)

[BrianMcBrayer]

Thank you for this answer!

Unfortunately it does not create the proper audit trail that is needed because it doesn't prove that the specific yarn install execution used that registry.

It would be nice if raising the verbosity level would show it. Currently the NpmHttpFetcher says that it is pulling the package (

berry/packages/plugin-npm/sources/NpmHttpFetcher.ts

Line 33 in 717c48c

onMiss: () => opts.report.reportCacheMiss(locator, `${structUtils.prettyLocator(opts.project.configuration, locator)} can't be found in the cache and will be fetched from the remote server`),

) -- I would love it if it included the URL that it is pulling from. If I were to make a PR to that, do you think that would be accepted?

[merceyz]

While it wont log the registries if everything is fine, you can use networkSettings to only allow domains that you trust https://yarnpkg.com/configuration/yarnrc#networkSettings

networkSettings:
  '*':
    enableNetwork: false
  'registry.yarnpkg.com':
    enableNetwork: true

[BrianMcBrayer]

I appreciate the answer! This will not give me an audit log though. I need to store a log of which packages were pulled from where. The reason why I think this is important is that I believe the industry will want this in the long run, especially with the high visibility security issues lately.

[paul-soporan]

Continued in #3765.