Expand packageManager description with allowed & recommended hash values

What would you like?

In the README section When Authoring Packages, expand the description to cover acceptable and recommended hash values. It should also describe how to determine correct hash values and which format is needed for Corepack.

Why is this needed?

It should be clear how to construct a valid packageManager definition with a hash, whether using a hash as part of a command or if manually editing packageManager into package.json.

The npm cli directly displays sha1 (shasum) and sha512 (integrity in BASE64) hashes for a requested package. For example:

$ npm view pnpm@10.1.0 dist
{
  shasum: 'ab7948c89104fdd3fc88b5b391fa4b73fd800631',
  tarball: 'https://registry.npmjs.org/pnpm/-/pnpm-10.1.0.tgz',
  fileCount: 1206,
  integrity: 'sha512-yJhHsGZ92rUDlru9AIoqQ887WB79Wc9dmqiSPqH7S4EGwEHVQNCKywlQN1lNc+vFHh7InuQMiLMLimbA+uCsGw==',
  signatures: [
    {
      sig: 'MEUCIQDlkgmNyZjT7KUY8AO6jH7Gs3fyiXG8nbTnuLbd8fOS2AIgXyJ6SaYhumMFzUYQAZPJGhsnlaD5N0X2MZsbG+eS/Xo=',
      keyid: 'SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U'
    }
  ],
  unpackedSize: 18870570
}

Other

• Since Corepack does not use the live copy of https://registry.npmjs.org/-/npm/v1/keys, if keys are rotated and used to sign packages, then Corepack users may have difficulty installing newer package managers. See issues
  • #612
  • #616
  • https://github.com/npm/cli/issues/8075
• corepack install or corepack use with a package manager hash can help to work around this issue.

Open the README's “When Authoring Packages” section and review the current packageManager description. Use the npm view output and the Corepack hash format mentioned in the issue to document acceptable and recommended values and how to obtain them. Done means the section explains both command-generated and manually edited packageManager definitions clearly.