add resolved field with url to a downloaded artifact to the lockfile

[iamstarkov]

Npm has it and its pretty nice and nifty feature
here an example value of the field https://github.com/npm/cli/blob/latest/package-lock.json#L211

[monperrus]

thanks for your suggestion.

that's interesting. is that for sake of traceability and provenance? or some other use case?

[monperrus]

plus this would allow tracing the actual registry used in multi-registry scenarios.

we're looking into this.

[iamstarkov]

It's a provenance thing