Install corepack@0.31.0 instead of hardcoding integrity keys #51819
+9
−12
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Closes #51796.
Ent PR: https://github.com/gravitational/teleport.e/pull/6008
In #51761, I initially just hardcoded the keys used by corepack to avoid updating the tooling. The whole situation seemed a bit fishy to me and the solution of "Just update corepack to the newest version" seemed to me on par with "Just ignore integrity checks", in that in the heat of the moment it'd be the simplest change to make which would unblock the rest of the team but also potentially introduce a malicious code to the project.
The dust has settled a bit since yesterday and following Fred's advice, I'm replacing the hardcoded keys with an updated version of corepack which has those updated keys baked in. Initially I thought we'd be able to remove the env var with keys when we'll get around to updating our Node.js version. But this might take some time and there's no guarantees that the new Node.js version used by Electron is going to actually have corepack >= 0.31.0.
We should still get rid of
npm install -g corepack@0.31.0
once we update Node.js to a version that comes with corepack >= 0.31.0, this has been reflected inbuild.assets/versions.mk
.I made a successful tag build with this PR and the ent PR. https://github.com/gravitational/teleport.e/actions/runs/13133912317