unhelpful error handling for integrity keys

Bắt đầu bằng cách lần theo verifySignature và fetchLatestStableVersion từ stack trace, sau đó kiểm tra cách COREPACK_INTEGRITY_KEYS được đọc và cách các chữ ký bị thiếu hoặc không khớp được báo cáo. Công việc được hoàn tất khi lỗi cấp thấp được thay thế bằng phần giải thích có thể hành động về tính toàn vẹn và có một trang tài liệu riêng bao quát việc cấu hình khóa, tắt các bước kiểm tra và cảnh báo malware liên quan.

When connecting corepack to a custom NPM registry such as Artifactory, then corepack presents unhelpful error messages about JSON objects missing keys.

++ yarn install
/opt/cloudbees/jenkins/.nvm/versions/node/v20.16.0/lib/node_modules/corepack/dist/lib/corepack.cjs:22457
  const key = keys.find(({ keyid }) => signatures.some((s) => s.keyid === keyid));
                                                  ^

TypeError: Cannot read properties of undefined (reading 'some')
    at /opt/cloudbees/jenkins/.nvm/versions/node/v20.16.0/lib/node_modules/corepack/dist/lib/corepack.cjs:22457:51
    at Array.find (<anonymous>)
    at verifySignature (/opt/cloudbees/jenkins/.nvm/versions/node/v20.16.0/lib/node_modules/corepack/dist/lib/corepack.cjs:22457:20)
    at fetchLatestStableVersion (/opt/cloudbees/jenkins/.nvm/versions/node/v20.16.0/lib/node_modules/corepack/dist/lib/corepack.cjs:22478:5)
    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
    at async fetchLatestStableVersion2 (/opt/cloudbees/jenkins/.nvm/versions/node/v20.16.0/lib/node_modules/corepack/dist/lib/corepack.cjs:22598:14)
    at async Engine.getDefaultVersion (/opt/cloudbees/jenkins/.nvm/versions/node/v20.16.0/lib/node_modules/corepack/dist/lib/corepack.cjs:23208:23)
    at async Engine.executePackageManagerRequest (/opt/cloudbees/jenkins/.nvm/versions/node/v20.16.0/lib/node_modules/corepack/dist/lib/corepack.cjs:23300:47)
    at async Object.runMain (/opt/cloudbees/jenkins/.nvm/versions/node/v20.16.0/lib/node_modules/corepack/dist/lib/corepack.cjs:24007:5)

This error is far too low level to communicate to the user what the real problem is: corepack is presently configured to expect packages to be signed by integrity keys, but the signatures are either missing or do not match the configured integrity keys.

Additionally, squirreled away in GitHub issues is a tip about setting a COREPACK_INTEGRITY_KEYS environment variable. To a blank, empty string. Or to zero. Or to false.

It would be helpful for error messages about integrity mismatches to link to a dedicated corepack integrity key documentation page. The page should explain loudly, clearly, and early, that in practice, integrity violations may indicate a middle man attack injection malware into any packages downloaded via corepack and/or yarn.

Secondly, the documentation page should show the correct syntax for configuring actual integrity keys.

Third, the documentation page should pick just one value, e.g. blank string ("") to indicate when the user chooses to exlicitly disregard integrity checks. This option should come with a warning that disabling integrity checks invites malware.