title: NPM package-lock.json causes npm install to fail on Linux
body: <p>So I just updated NPM on my Mac and it generated a lock file on a project. "Hey - that's great" I say and commit it. Then my build fails on Travis CI with the following:</p>
  
  <pre><code>Compiling Frontend Assets
  npm WARN optional SKIPPING OPTIONAL DEPENDENCY: fsevents@^1.0.0 (node_modules/chokidar/node_modules/fsevents):
  npm WARN notsup SKIPPING OPTIONAL DEPENDENCY: Unsupported platform for fsevents@1.1.2: wanted {"os":"darwin","arch":"any"} (current: {"os":"linux","arch":"x64"})
  npm ERR! Linux 4.4.0-83-generic
  npm ERR! argv "/home/travis/.nvm/versions/node/v7.4.0/bin/node" "/home/travis/.nvm/versions/node/v7.4.0/bin/npm" "install"
  npm ERR! node v7.4.0
  npm ERR! npm  v4.0.5
  npm ERR! shasum check failed for /tmp/npm-9017-ad78fe01/registry.npmjs.org/hawk/-/hawk-3.1.3.tgz
  npm ERR! Expected: 078444bd7c1640b0fe540d2c9b73d59678e8e1c4
  npm ERR! Actual:   282a21cacac687357d149e149c408a3c0506695c
  npm ERR! From:     https://registry.npmjs.org/hawk/-/hawk-3.1.3.tgz
  npm ERR! 
  npm ERR! If you need help, you may report this error at:
  npm ERR!     &lt;https://github.com/npm/npm/issues&gt;
  npm ERR! Please include the following file with any support request:
  npm ERR!     /home/travis/build/project/npm-debug.log
  make: *** [frontend] Error 1
  </code></pre>
  
  <p>It's a Symfony project but I use NPM for SCSS, JS compiling and copying images and fonts etc to the web directory. I'm projecting that this probably has something to do with differences in packages for OSX &amp; Linux - which I have experienced before with an image processing package.</p>
  
  <p>Or it could be due to the version of NPM that travis is using here?</p>
  
  <p>I have 5.3.0 on my local machine now.</p>
  
  <p>Or is it something I just don't understand about the lock file for npm? Could it be that it's trying to validate the packages installed...</p>
  
  <p>My <code>package.json</code> looks like this. The issue is obviously with a dependency of a dependency. I'm wondering if I should just .gitignore the lock file if it's going to cause this kind of conflict. And I'm not sure if I need to start down the route of making sure all versions of node and npm are identical across all platforms that run builds.</p>
  
  <pre><code>{
    "name": "project",
    "version": "1.0.0",
    "description": "project",
    "main": "index.js",
    "scripts": {
       ... front end build scripts
    },
    ... ,
    "devDependencies": {
      "autoprefixer": "^7.1.2",
      "bulma": "^0.5.1",
      "chokidar-cli": "^1.2.0",
      "cssnano": "^3.10.0",
      "font-awesome": "^4.7.0",
      "jquery": "^3.2.1",
      "jshint": "^2.9.5",
      "mkdirp": "^0.5.1",
      "node-sass": "^4.5.3",
      "npm-run-all": "^4.0.2",
      "postcss-cli": "^4.1.0",
      "uglifyjs-folder": "^1.1.0"
    }
  }
  </code></pre>