Instead of hardcoding NPM signing keys for verification we get them from
sigstore’s TUF repository. This is in line with how npm implements
signature verification.
Fixes#616, fixes#612
When the user has not provided any hash (so when running `corepack up`/`corepack use …`), and the package manager is downloaded from the npm registry, we can verify the signature.
BREAKING CHANGE: attempting to download a version from the npm registry (or a mirror) that was published using the now deprecated PGP signature without providing a hash will trigger an error. Users can disable the signature verification using a environment variable.
Thomas Scholtes
Antoine du Hamel
Leonardo Rocha
zhyupe
Kristoffer K
Michael Stramel
Maël Nison
Mike Scott