Publish tarballs with .tgz extension

[eps1lon]

Not sure if this is appropriate here.

yarn v2 no longer installs packages from arbitrary urls.

Right now

diff --git a/package.json b/package.json
index 2f92273..b2e2b2a 100644
--- a/package.json
+++ b/package.json
@@ -3,6 +3,7 @@
   "version": "0.1.0",
   "private": true,
   "dependencies": {
+    "@material-ui/core": "https://pkg.csb.dev/mui-org/material-ui/commit/e9a9cdb2/@material-ui/core",
     "@testing-library/jest-dom": "^5.11.4",
     "@testing-library/react": "^11.1.0",
     "@testing-library/user-event": "^12.1.10",

fails with

$ yarn
➤ YN0000: ┌ Resolution step
➤ YN0001: │ Error: @material-ui/core@https://pkg.csb.dev/mui-org/material-ui/commit/e9a9cdb2/@material-ui/core isn't supported by any available resolver
    at i.getResolverByDescriptor (/home/eps1lon/Development/throwaway/cra4-mui5-react17/.yarn/releases/yarn-2.3.3.cjs:2:314629)

I asked in their discord and they confirmed that tarballs need the .tgz extension. I tried if this url already existed but got a 404: https://pkg.csb.dev/mui-org/material-ui/commit/e9a9cdb2/@material-ui/core.tgz

Alternatives:

1. download as .tgz and install does not work since the codesandbox replaced dependency ranges with https://csb.*
2. write custom yarn resolver

[markerikson]

Another option would be to include Yarn v2-specific instructions. Per yarnpkg/berry#3327 (comment) :

A workaround would be to use a url hash: yarn add @reduxjs/toolkit@https://pkg.csb.dev/reduxjs/redux-toolkit/commit/7491320d/@reduxjs/toolkit#.tgz

[merceyz]

Ideally it would show the following regardless of the Yarn version

yarn add @reduxjs/toolkit@https://pkg.csb.dev/reduxjs/redux-toolkit/commit/7491320d/@reduxjs/toolkit/_pkg.tgz

(Got the URL from codesandbox/codesandbox-client#6055 (comment))

[Andarist]

The problem with proposed workaround is that it only works for the package that u want to install explicitly. However, Yarn Berry still wont be able to install its dependencies as they are declared the same way and the user has no control over that.

I've put some additional context here: #34 (comment)

[Andarist]

If anyone is interested in a workaround for this issue - I've written a simple Yarn plugin that patches CSB dependency descriptors to correct ones, see here