Newly published versions of package managers distributed from npm cannot be installed due to key id mismatch

[sapphi-red]

This is probably related to #611.

When I try to install pnpm 10.1.0, I get the following error:

C:\Program Files\nodejs\node_modules\corepack\dist\lib\corepack.cjs:21535
  if (key == null || signature == null) throw new Error(`Cannot find matching keyid: ${JSON.stringify({ signatures, keys })}`);
                                              ^

Error: Cannot find matching keyid: {"signatures":[{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEUCIQDlkgmNyZjT7KUY8AO6jH7Gs3fyiXG8nbTnuLbd8fOS2AIgXyJ6SaYhumMFzUYQAZPJGhsnlaD5N0X2MZsbG+eS/Xo="}],"keys":[{"expires":null,"keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA","keytype":"ecdsa-sha2-nistp256","scheme":"ecdsa-sha2-nistp256","key":"MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE1Olb3zMAFFxXKHiIkQO5cJ3Yhl5i6UPp+IhuteBJbuHcA5UogKo0EWtlWwW6KSaKoTNEYL7JlCQiVnkhBktUgg=="}]}
    at verifySignature (C:\Program Files\nodejs\node_modules\corepack\dist\lib\corepack.cjs:21535:47)
    at installVersion (C:\Program Files\nodejs\node_modules\corepack\dist\lib\corepack.cjs:21882:7)
    at process.processTicksAndRejections (node:internal/process/task_queues:105:5)
    at async Engine.ensurePackageManager (C:\Program Files\nodejs\node_modules\corepack\dist\lib\corepack.cjs:22316:32)
    at async Engine.executePackageManagerRequest (C:\Program Files\nodejs\node_modules\corepack\dist\lib\corepack.cjs:22416:25)
    at async Object.runMain (C:\Program Files\nodejs\node_modules\corepack\dist\lib\corepack.cjs:23102:5)        

Node.js v22.13.0

I checked https://registry.npmjs.org/pnpm/10.1.0 and it contains

{
  "signatures": [
    {
      "keyid": "SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U",
      "sig": "MEUCIQDlkgmNyZjT7KUY8AO6jH7Gs3fyiXG8nbTnuLbd8fOS2AIgXyJ6SaYhumMFzUYQAZPJGhsnlaD5N0X2MZsbG+eS/Xo="
    }
  ]
}

which has the same key id distributed at https://registry.npmjs.org/-/npm/v1/keys.
On the other hand, pnpm@10.0.0 (https://registry.npmjs.org/pnpm/10.0.0) has:

{
  "signatures": [
    {
      "sig": "MEUCIBhQnfDt9V8tw3FnrqHdMokyqJJtYX7HhR5NxvfggwP/AiEAiQQ74inA/JVI5IHN0piTLb2LhSUPJAkYYsGgM8DTrCI=",
      "keyid": "SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA"
    }
  ]
}

which has the same key id in config.json.

corepack/config.json

Line 169 in 9dfbe18

"keyid": "SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA",

[MikeMcC399]

@sapphi-red

I can reproduce this issue on Windows 11 and Ubuntu 24.04.1 LTS with

corepack use pnpm@10.1.0

Cannot find matching keyid

---

corepack use pnpm@10.0.0

has no issue, so you might change your subject to be specifically 10.1.0 instead of the generic "Newly published versions".

Also, this should probably be reported to https://github.com/pnpm/pnpm/issues
cc: @zkochan

[SenseiMarv]

I can confirm that the same issue happens for us as well in our GitLab Pipeline:

$ corepack enable && corepack prepare --activate
Preparing pnpm@10.1.0 for immediate activation...
Internal Error: Cannot find matching keyid: {"signatures":[{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEUCIQDlkgmNyZjT7KUY8AO6jH7Gs3fyiXG8nbTnuLbd8fOS2AIgXyJ6SaYhumMFzUYQAZPJGhsnlaD5N0X2MZsbG+eS/Xo="}],"keys":[{"expires":null,"keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA","keytype":"ecdsa-sha2-nistp256","scheme":"ecdsa-sha2-nistp256","key":"MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE1Olb3zMAFFxXKHiIkQO5cJ3Yhl5i6UPp+IhuteBJbuHcA5UogKo0EWtlWwW6KSaKoTNEYL7JlCQiVnkhBktUgg=="}]}
    at verifySignature (/usr/lib/node_modules/corepack/dist/lib/corepack.cjs:21535:47)
    at installVersion (/usr/lib/node_modules/corepack/dist/lib/corepack.cjs:21882:7)
    at process.processTicksAndRejections (node:internal/process/task_queues:105:5)
    at async Engine.ensurePackageManager (/usr/lib/node_modules/corepack/dist/lib/corepack.cjs:22316:32)
    at async PrepareCommand.execute (/usr/lib/node_modules/corepack/dist/lib/corepack.cjs:23025:27)
    at async PrepareCommand.validateAndExecute (/usr/lib/node_modules/corepack/dist/lib/corepack.cjs:19835:22)
    at async _Cli.run (/usr/lib/node_modules/corepack/dist/lib/corepack.cjs:20772:18)
    at async Object.runMain (/usr/lib/node_modules/corepack/dist/lib/corepack.cjs:23097:19)

[sapphi-red]

I assume the signatures are generated by npm registry and pnpm has no control over it. I'll change the issue name to specifically 10.1.0, but I believe any versions that are published from now on will be affected, as I think it's caused by npm registry's key rotation.
I wonder if the npm registry had to rotate the key immediately (and not in a gradual manner) due to some vulnerability discovery.

[sapphi-red]

For those who are facing this issue like me, you can add COREPACK_INTEGRITY_KEYS=0 env var to skip the signature check.

[DaveEvans-Thalamos]

We're pinned to 9.15.4 and seeing this on CI, so it's not limited to 10.1.0

[DaveEvans-Thalamos]

For those who are facing this issue like me, you can add COREPACK_INTEGRITY_KEYS=0 env var to skip the signature check.

Whilst this may work around the issue and is tempting, if there is an undisclosed vulnerability behind all of this as you speculate, then ignoring the key integrity might result in running evil code.

[MikeMcC399]

@sapphi-red

I assume the signatures are generated by npm registry and pnpm has no control over it. I'll change the issue name to specifically 10.1.0, but I believe any versions that are published from now on will be affected, as I think it's caused by npm registry's key rotation. I wonder if the npm registry had to rotate the key immediately (and not in a gradual manner) due to some vulnerability discovery.

• The endpoint https://registry.npmjs.org/-/npm/v1/keys (mentioned for instance in the documentation https://docs.npmjs.com/about-registry-signatures) is currently returning two different keys without much discernable pattern as to which key will be returned. This is mentioned in issue config.test randomly failing in CI (key store should be up-to-date) #611. The server farm responding to https://registry.npmjs.org includes 24 different IP addresses and I guess it depends on exactly which Cloudflare server the request hits. I don't know the reason for the two different keys and probably it should be raised to https://www.npmjs.com/support for clarification / remediation.

[sapphi-red]

For those who are facing this issue like me, you can add COREPACK_INTEGRITY_KEYS=0 env var to skip the signature check.

Whilst this may work around the issue and is tempting, if there is an undisclosed vulnerability behind all of this as you speculate, then ignoring the key integrity might result in running evil code.

Isn't it the opposite? If the key was rotated, the old key cannot be trusted and the new key can be trusted. The current corepack only checks the old key. To be strictly safe, you shouldn't install any packages signatured with the old key and only use packages signatured with the new key, and given that corepack does not check the signature with the new key, you need to manually check it.

[sapphi-red]

• I don't know the reason for the two different keys and probably it should be raised to https://www.npmjs.com/support for clarification / remediation.

I've sent a message there linking this and that issue 👍

[MikeMcC399]

• There is now an issue reported against pnpm Installing pnpm 10.1.0 on windows fails with cannot find matching keyid pnpm/pnpm#9014

[hmaack]

While using the latest-10 tag is not working right now, a pinned version can help to get your CI running 🐌

corepack prepare pnpm@10.0.0 --activate