No checksum for conditional dependencies?

[niklaskorz]

I'll first open this as a discussion before opening an issue, so I can figure out of this is intentional behavior or a bug. Conditional dependencies that have more than one condition seem to be lacking a checksum in the lockfile.

This can be observed in yarn's own lockfile, e.g. here with os=darwin & cpu=arm64:

berry/yarn.lock

Lines 9719 to 9724 in 13d5b30

	"esbuild-darwin-arm64@npm:0.15.11":
	version: 0.15.11
	resolution: "esbuild-darwin-arm64@npm:0.15.11"
	conditions: os=darwin & cpu=arm64
	languageName: node
	linkType: hard

Every entry with multiple condition rules lacks a checksum.

Meanwhile, the one conditional dependency here that has only a single condition os=darwin has a checksum:

berry/yarn.lock

Lines 10981 to 10989 in 13d5b30

	"fsevents@npm:^2.3.2, fsevents@npm:~2.3.2":
	version: 2.3.2
	resolution: "fsevents@npm:2.3.2"
	dependencies:
	node-gyp: "npm:latest"
	checksum: 10/6b5b6f5692372446ff81cf9501c76e3e0459a4852b3b5f1fc72c103198c125a6b8c72f5f166bdd76ffb2fca261e7f6ee5565daf80dca6e571e55bcc589cc1256
	conditions: os=darwin
	languageName: node
	linkType: hard

Even if this is intentional behavior, what's the reasoning behind it? This make it harder to map yarn to graph-based isolated build environments like Nix.

[arcanis]

Even if this is intentional behavior, what's the reasoning behind it? This make it harder to map yarn to graph-based isolated build environments like Nix.

Since they are not downloaded, we can't compute their checksum. We can still lock their versions though so they are the same across all environments.

[niklaskorz]

Thank your for the explanation! I also now found the origin of this:

berry/packages/yarnpkg-core/sources/Cache.ts

Lines 490 to 493 in 13d5b30

	// We hide the checksum if the package presence is conditional, because it becomes unreliable
	const exposedChecksum = !opts.unstablePackages?.has(locator.locatorHash)
	? checksum
	: null;

This is somewhat problematic as the hash needs to be known for any network access in Nix, but I think I found a workaround for now. We're using https://github.com/madjam002/yarnpnp2nix, which is a Yarn plugin, so it has direct access to Yarn's store functions, including those for getting checksums of cached files. By setting supportedArchitectures to include all configurations that we need in our build environment, we can get the checksums missing in the lockfile for the cached files. This might not be interesting for you personally, but I'll put it here in case anyone else runs into this problem.