Support custom binary hosting mirror

[fengmk2]

Like we setup a mirror site for node-inspector at
https://npm.taobao.org/mirrors/node-inspector/

These mirrors try to help people download binary files from China.

$ npm install node-inspector \
  --profiler_binary_host_mirror=https://npm.taobao.org/mirrors/node-inspector/

[springmeyer]

I'm hesitant to accept this due to security concerns. So let's work together to brainstorm here if there is a safe way to allow this. My concern is that a malicious application could set this ENV variable (perhaps by writing to ~/.bash_profile) and then a user would unknowingly be installing binaries from a different location.

Possible solutions:

• add support for shasum validation - this would not completely protect the user but would make it much harder to sneak in malicious binaries
• require a custom flag be passed to support mirrors like npm install --allow-binary-mirror. Only when that flag is passed would the ENV option be respected.
• use the npm config infrastructure instead of an arbitrary ENV option like discussed at Overriding "host" to point to alternative binary repository #74

[fengmk2]

How about follow npm install config options?

$ npm install node-inspector --profiler_binary_host_mirror=http://npm.taobao.org/mirrors/node-inspector/

And the process.env.npm_config_profiler_binary_host_mirror env it's set by npm.

[springmeyer]

Latest fix looks good. Can you think of a good way to test this on travis?

[fengmk2]

OK, I try to add test for this change.

[fengmk2]

@springmeyer unittest added.

[fengmk2]

@springmeyer travis pass now

[afc163]

+1

[fengmk2]

@springmeyer review again?

[yiminghe]

We need this in china 👍

[sorrycc]

+1

[antife-yinyue]

👍

[nightink]

👍

[fengmk2]

@springmeyer can you review this again?

[springmeyer]

Great, @fengmk2 will merge once you can:

• Rebase against latest master and ensure the tests pass
• Add docs to the README.md

Sound good? Thanks for this.

[fengmk2]

Sure, I will do it today.

[fengmk2]

@springmeyer rebase and docs done!

[springmeyer]

Thanks @fengmk2!

[fengmk2]

Great!