feat: use integrity field from yarn.lock as sha512 for nix derivation

Based off canva-public#11

Author: andrew-vts

lib/print.js

@@ -157,7 +157,7 @@ class Package {
    *   src: {
    *    type: 'url',
    *    url: string,
-   *    sha1?: string,
+   *    hash?: string,
    *   } | {
    *    type: 'local',
    *   },
@@ -200,25 +200,34 @@ class Package {
    */
   static create(
     pkgInfo,
-    // @ts-ignore because there is no optionalDependencies in the type
-    { version, resolved, dependencies = {}, optionalDependencies = {} }
+    // @ts-ignore because type lacks: integrity, optionalDependencies
+    { version, integrity, resolved, dependencies = {}, optionalDependencies = {} }
   ) {
     const { scope = '', name } = Id.parse(pkgInfo.name);
 
     /** @type {Package['src']} */
     let src;
     if (resolved && resolved.startsWith('https')) {
       const parsedUrl = new URL(resolved);
+      let hash = integrity;
+
       // prettier-ignore
-      if (['registry.yarnpkg.com', 'registry.npmjs.org'].includes(parsedUrl.host)) {
+      if (!hash && ['registry.yarnpkg.com', 'registry.npmjs.org'].includes(parsedUrl.host)) {
+        const urlSha1 = parsedUrl.hash.slice(1);
+        if (urlSha1) {
+          hash = `sha1-${urlSha1}`;
+        }
+      }
+
+      if (hash) {
         src = {
-          sha1: parsedUrl.hash.slice(1), // cut off the first ('#') character
+          hash,
           url: parsedUrl.origin + parsedUrl.pathname,
           type: 'url',
         };
       } else {
         src = {
-          sha1: undefined, // We don't provide sha in order to force to override it manually
+          hash: undefined, // We don't provide hash in order to force to override it manually
           url: parsedUrl.origin + parsedUrl.pathname,
           type: 'url',
         };
@@ -306,7 +315,7 @@ class Package {
   renderSrc() {
     switch (this.src.type) {
       case 'url':
-        const { url, sha1 } = this.src;
+        const { url, hash } = this.src;
         // Some of the urls can look like "https://codeload.github.com/xolvio/cucumber-js/tar.gz/cf953cb5b5de30dbcc279f59e4ebff3aa040071c",
         // i.e. no extention given. That's why Nix unable to recognize the type of archive so we need to have
         // name specified explicitly to all Nix to infer the archive type.
@@ -339,13 +348,8 @@ class Package {
             : ''
         }
       url = "${url}";
-      ${
-        sha1
-          ? `sha1 = "${sha1}"`
-          : `sha256 = abort ''
-
-
-        Failed to infer \`sha256\` hash of the \`${this.renderKey()}\` package source from
+      hash = ${hash ? `"${hash}"` : `abort ''
+        Failed to infer hash of the \`${this.renderKey()}\` package source from
         \`${url}\`.
 
         Override \`"${this.renderKey()}".src.sha256\` attribute in order to provide this missing piece to Nix.