Adds an auto-add-integrity option

__tests__/commands/install/integration.js

@@ -738,6 +738,15 @@ test('install should create integrity field if not present', () =>
     // backwards-compatibility
   }));
 
+test('install should not create the integrity field if missing and auto-add-integrity is false', () =>
+  runInstall({}, 'install-update-auth-no-integrity-field-no-auto-add', async config => {
+    const lockFileContent = await fs.readFile(path.join(config.cwd, 'yarn.lock'));
+    const lockFileLines = explodeLockfile(lockFileContent);
+    expect(await fs.exists(path.join(config.cwd, 'node_modules', 'safe-buffer'))).toEqual(true);
+    expect(lockFileLines[2].indexOf('#893312af69b2123def71f57889001671eeb2c853')).toBeGreaterThan(0);
+    expect(lockFileLines.length).toEqual(3);
+  }));
+
 test('install should ignore existing hash if integrity is present even if it fails to authenticate it', () =>
   expect(runInstall({}, 'install-update-auth-bad-sha512-good-hash')).rejects.toMatchObject({
     message: expect.stringContaining("computed integrity doesn't match our records"),

__tests__/fixtures/install/install-update-auth-no-integrity-field-no-auto-add/.yarnrc

@@ -0,0 +1 @@
+auto-add-integrity false

__tests__/fixtures/install/install-update-auth-no-integrity-field-no-auto-add/package.json

@@ -0,0 +1,9 @@
+{
+  "name": "install-update-auth-no-integrity-field",
+  "version": "1.0.0",
+  "main": "index.js",
+  "license": "MIT",
+  "dependencies": {
+    "safe-buffer": "^5.1.1"
+  }
+}

__tests__/fixtures/install/install-update-auth-no-integrity-field-no-auto-add/yarn.lock

@@ -0,0 +1,7 @@
+# THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
+# yarn lockfile v1
+
+
+safe-buffer@^5.1.1:
+  version "5.1.1"
+  resolved "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.1.1.tgz#893312af69b2123def71f57889001671eeb2c853"

src/config.js

@@ -192,6 +192,8 @@ export default class Config {
   focus: boolean;
   focusedWorkspaceName: string;
 
+  autoAddIntegrity: boolean;
+
   /**
    * Execute a promise produced by factory if it doesn't exist in our cache with
    * the associated key.
@@ -368,6 +370,9 @@ export default class Config {
     this.linkFileDependencies = Boolean(this.getOption('yarn-link-file-dependencies'));
     this.packBuiltPackages = Boolean(this.getOption('experimental-pack-script-packages-in-mirror'));
 
+    const autoAddIntegrity = this.getOption('auto-add-integrity');
+    this.autoAddIntegrity = Boolean(typeof autoAddIntegrity !== 'undefined' ? autoAddIntegrity : true);
+
     //init & create cacheFolder, tempFolder
     this.cacheFolder = path.join(this._cacheRootFolder, 'v' + String(constants.CACHE_VERSION));
     this.tempFolder = opts.tempFolder || path.join(this.cacheFolder, '.tmp');

src/resolvers/registries/npm-resolver.js

@@ -207,8 +207,8 @@ export default class NpmResolver extends RegistryResolver {
         }
       }
     }
-    if (shrunk && shrunk._remote && shrunk._remote.integrity) {
-      // if the integrity field does not exist, it needs to be created
+    if (shrunk && shrunk._remote && (shrunk._remote.integrity || !this.config.autoAddIntegrity)) {
+      // if the integrity field does not exist, it needs to be created unless the feature is disabled
       return shrunk;
     }