Berry: [Bug] placeholder tarball URL breaks Verdaccio

[mprast]

• [x] I'd be willing to implement a fix

Describe the bug
I'm having some troubling using Verdaccio as a private npm repository, and It appears that the culprit is the dist.tarball field in the package.json file of my tarballed packages. It looks like this always gets set to a dummy value: https://github.com/yarnpkg/berry/blob/master/packages/plugin-npm-cli/sources/commands/npm/publish.ts#L189. While npm may not use this field, Verdaccio uses it to find the location to serve the tarball from:
https://github.com/verdaccio/verdaccio/blob/a616250e331e6dc06b909951bf1319cf063128c4/src/lib/utils.ts#L179. The end result for me is that yarn is unable to fetch packages from Verdaccio, although it can still push packages to it.

To Reproduce

(Unfortunately I couldn't find a way to reproduce this in Sherlock, but I did make a minimal reproduction in a repo I'll link here. Also, FYI, this link in your documentation appears to be broken.)

repro instructions:

1. clone the repo here
2. yarn to install verdaccio
3. start server with yarn run verdaccio and then ctrl-c out of it to initialize verdaccio config in the home dir
4. ./verdaccio-setup.sh to turn off auth for pushing to verdaccio
5. run verdaccio with yarn run verdaccio in a separate terminal window
6. ./package-setup.sh to publish packageB
7. ./test.sh to try pulling packageB down. output in terminal should contain

YN0001: │ HTTPError: packageB@npm:0.0.2::__archiveUrl=http%3A%2F%2Flocalhost%3A4873%2FpackageB%2F-%2Fhere.tgz: Response code 404 (Not Found)

output in verdaccio console should contain

http <-- 404, user: null(127.0.0.1), req: 'GET /packageB/-/here.tgz', error: no such file available

1. ./fix.sh to modify the tarball field in the package.json of the published package.
2. ./test.sh again - this time it should run with no issue.

Environment if relevant (please complete the following information):

• OS: Fedora 30
• Node version: 10.16.0
• Yarn version: 2.0.0-rc.29
• verdaccio version: 4.4.3

Thank you!

[arcanis]

What do you think, @juanpicado? Could that be a bug in Verdaccio? Otherwise I guess we can use the real file name (${name}-${version}.tgz) instead of here.tgz, but I'd expect Verdaccio to use the filename we sent in the _attachment field.

[juanpicado]

I will take a look over the weekend, it sounds familiar.

[juanpicado]

Fixed by @nicolo-ribaudo here https://github.com/yarnpkg/berry/pull/987

[mprast]

@nicolo-ribaudo @juanpicado @arcanis thank you for the fix! verified that this fixes the repro so I'll close.