Renovate: Integrity check failure for yarn offline mirror (regression)

[sampi]

What Renovate type are you using?

Self-hosted Renovate bot on self-hosted GitLab

Describe the bug

When using yarn v1's offline mirror function, the .tgz files are corrupted.

Did you see anything helpful in debug logs?

I don't have access to the logs of the broken build but everything looks the same as the issue in #4126

$ yarn --offline --frozen-lockfile --link-duplicates
 yarn install v1.22.0
 [1/4] Resolving packages...
 [2/4] Fetching packages...
 error Can't make a request in offline mode ("https://registry.yarnpkg.com/next-cookies/-/next-

To Reproduce

Additional context

• This issue was reported and fixed before on Jul 19:

  • https://github.com/renovatebot/renovate/issues/4126
  • https://github.com/renovatebot/renovate/pull/4102

• The fix was reverted on Jul 24

  • https://github.com/renovatebot/renovate/pull/4166/files#diff-05e7baf6dfa28aa3272ce25561b6e8fcR508

[rarkins]

@sampi can you reproduce it in a public repo?

[rarkins]

The utf8 param appears to still be there: https://github.com/renovatebot/renovate/blob/1e0163a45b906d176abb107fc740cdeccc0b6cb1/lib/manager/npm/post-update/index.ts#L483

[sampi]

the utf-8 param, that you yourself removed: https://github.com/renovatebot/renovate/commit/34a96ad327b880ba49b9fec3ee7ea69d96889bf3#diff-05e7baf6dfa28aa3272ce25561b6e8fcL508-R508

[rarkins]

Sorry, I mixed up the "direction" of that diff. Taking a look now

[rarkins]

A reproduction repo would definitely help though

[sampi]

I've asked the DevOps guys to help me out, I mostly focus on UI development, hopefully they can help me out soon.

[sampi]

I can show you this in the meantime, here are two different .tgz files for [email protected], one generated by the Renovate bot, the other one with rm -rf ./.yarn/cache && yarn

Renovate bot: https://drive.google.com/open?id=1sOJVEwAf2zhxKNrCw1WixenXkfpjEyOZ

yarn: https://drive.google.com/open?id=13sep7StlNQfELKnCMKrKUxtzCCLcXnlu

[sampi]

I have made a repo where I believe I can trigger the error, but I am not getting the initial Configuration MR.

https://gitlab.com/sampi1/yarn-offline

I have set up the bot as developer and also the webhook using the dashboard, so I guess it's just a matter of time.

[rarkins]

Unfortunately this can't be used as a reproduction because it doesn't have any PRs required.

[sampi]

@rarkins
Just needed to give it some time!

Here is a GitLab CI build log that failed with the expected error: https://gitlab.com/sampi1/yarn-offline/-/jobs/435089451
Here is the MR: https://gitlab.com/sampi1/yarn-offline/-/merge_requests/2

For some reason, there are two Renovate JOB_IDs: 140789044 and 140789046

[sampi]

Actually, I reproduced another error... The new .tgz wasn't added to the commit but the old file was removed.

Very strange...

[rarkins]

Just needed to give it some time!

Actually what was missing was this commit that you added after I took a copy:

[rarkins]

My copy now is able to reproduce the problem and also now verify the fix: https://github.com/renovate-tests/yarn-offline/pull/1/files

[renovate-release]

:tada: This issue has been resolved in version 19.131.9 :tada:

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot :package::rocket:

[sampi]

Thanks! Looking forward to testing it and seeing MRs get merged in without human interference!