Expand packageManager description with allowed & recommended hash values

打开 README 的“When Authoring Packages”部分，并检查当前的 packageManager 描述。使用 npm view 的输出和 issue 中提到的 Corepack 哈希格式，记录可接受和推荐的值以及获取这些值的方法。当该部分清楚地说明通过命令生成的 packageManager 定义和手动编辑的 packageManager 定义时，即视为完成。

What would you like?

In the README section When Authoring Packages, expand the description to cover acceptable and recommended hash values. It should also describe how to determine correct hash values and which format is needed for Corepack.

Why is this needed?

It should be clear how to construct a valid packageManager definition with a hash, whether using a hash as part of a command or if manually editing packageManager into package.json.

The npm cli directly displays sha1 (shasum) and sha512 (integrity in BASE64) hashes for a requested package. For example:

$ npm view pnpm@10.1.0 dist
{
  shasum: 'ab7948c89104fdd3fc88b5b391fa4b73fd800631',
  tarball: 'https://registry.npmjs.org/pnpm/-/pnpm-10.1.0.tgz',
  fileCount: 1206,
  integrity: 'sha512-yJhHsGZ92rUDlru9AIoqQ887WB79Wc9dmqiSPqH7S4EGwEHVQNCKywlQN1lNc+vFHh7InuQMiLMLimbA+uCsGw==',
  signatures: [
    {
      sig: 'MEUCIQDlkgmNyZjT7KUY8AO6jH7Gs3fyiXG8nbTnuLbd8fOS2AIgXyJ6SaYhumMFzUYQAZPJGhsnlaD5N0X2MZsbG+eS/Xo=',
      keyid: 'SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U'
    }
  ],
  unpackedSize: 18870570
}

Other

• Since Corepack does not use the live copy of https://registry.npmjs.org/-/npm/v1/keys, if keys are rotated and used to sign packages, then Corepack users may have difficulty installing newer package managers. See issues
  • #612
  • #616
  • https://github.com/npm/cli/issues/8075
• corepack install or corepack use with a package manager hash can help to work around this issue.