sl-blip makes strongloop projects unusable with safestart / package ver validators

[STRML]

I've made an issue before about what I believe to be an abusive use of npm's optionalDependencies via sl-blip: #1079

This is also preventing package version validation modules like safestart from being used with strongloop projects.

For example:

/srv/api/node_modules/safestart/index.js:88
    throw error
          ^
Error: loopback-connector-remote dependency mismatch: sl-blip from /srv/api/node_modules/loopback/node_modules/sl-blip (expected: http://blip.strongloop.com/loopback-connector-remote@1.0.3, got: http://blip.strongloop.com/loopback@2.22.0)
    at fail (/srv/api/node_modules/safestart/index.js:83:17)
    at /srv/api/node_modules/safestart/index.js:73:17
    at Array.forEach (native)
    at scanDependencies (/srv/api/node_modules/safestart/index.js:47:38)
    at checkPath (/srv/api/node_modules/safestart/index.js:40:5)
    at /srv/api/node_modules/safestart/index.js:54:26
    at Array.forEach (native)
    at scanDependencies (/srv/api/node_modules/safestart/index.js:47:38)
    at checkPath (/srv/api/node_modules/safestart/index.js:39:5)
    at /srv/api/node_modules/safestart/index.js:54:26

Please remove blip.

[rmg]

This appears to be a combination of npm bugs that safestart is shining a light on :-(

• packages from different URLs are clobbering the cache (npm install of git urls overwrites registry packages in cache npm/npm#4042)
• npm isn't installing the correct URL specified dependency (Wrong dependency version installed 2 Levels Deep with git urls npm/npm#8429)

There's also a very minor bug in safestart in that it is identifying these URLs as git URLs, though that could just be an unfortunate choice in variable naming :-)

[richardpringle]

@rmg, this isn't a "loopback-core" issue is it? In other words, should this be closed and moved to another repo?

[STRML]

@richardpringle Perhaps you can get someone from strongloop to comment on #1079 and consider removing sl-blip instead of surreptitiously tracking users?

[richardpringle]

Hey @STRML, I'm going through the issues and doing some bug fixes on some of the loopback code so I just want to make sure the right person is looking at this.
Just trying to help.

[STRML]

Thanks @richardpringle -- appreciate it.