[Fix] nvm_download_artifact: without a checksum tool, fail before touching the cache or downloading

Previously, every download was refused only after it was fetched,
a verified cached archive was deleted as "broken",
and the source fallback then downloaded a second archive that was refused the same way,
with no message saying what to install.

.github/workflows/latest-npm.yml

@@ -37,6 +37,8 @@ jobs:
       matrix:
         node-version: ${{ fromJson(needs.matrix.outputs.latest) }}
         include:
+          - node-version: "24.14"
+          - node-version: "22.22.1"
           - node-version: "21"
           - node-version: "20.5"
           - node-version: "20.4"

README.md

@@ -540,7 +540,7 @@ nvm install --offline 14.7.0
 
 This resolves versions using only locally installed versions and cached downloads. It will not attempt to download anything. This is useful in air-gapped environments, on planes, or when you want to avoid network latency.
 
-A download is only added to the cache (`$NVM_DIR/.cache`) once its checksum has been verified (unless no checksum tool is available, in which case `nvm` warns that it is continuing without verification). `--offline` does not verify cached archives again, so anything placed in the cache by other means is trusted as-is.
+A download is only added to the cache (`$NVM_DIR/.cache`) once its checksum has been verified. `--offline` does not verify cached archives again, so anything placed in the cache by other means is trusted as-is.
 
 You can combine `--offline` with `--lts` to install the latest cached LTS version (as long as LTS aliases have been populated by a prior `nvm ls-remote --lts`):
 

nvm.sh

@@ -680,6 +680,31 @@ nvm_install_latest_npm() {
     if [ $NVM_IS_21_OR_ABOVE -eq 1 ] && nvm_version_greater_than_or_equal_to "${NODE_VERSION}" 22.9.0; then
       NVM_IS_22_9_OR_ABOVE=1
     fi
+    local NVM_IS_22_22_2_OR_ABOVE
+    NVM_IS_22_22_2_OR_ABOVE=0
+    if [ $NVM_IS_22_9_OR_ABOVE -eq 1 ] && nvm_version_greater_than_or_equal_to "${NODE_VERSION}" 22.22.2; then
+      NVM_IS_22_22_2_OR_ABOVE=1
+    fi
+    local NVM_IS_23_OR_ABOVE
+    NVM_IS_23_OR_ABOVE=0
+    if [ $NVM_IS_22_22_2_OR_ABOVE -eq 1 ] && nvm_version_greater_than_or_equal_to "${NODE_VERSION}" 23.0.0; then
+      NVM_IS_23_OR_ABOVE=1
+    fi
+    local NVM_IS_24_15_OR_ABOVE
+    NVM_IS_24_15_OR_ABOVE=0
+    if [ $NVM_IS_23_OR_ABOVE -eq 1 ] && nvm_version_greater_than_or_equal_to "${NODE_VERSION}" 24.15.0; then
+      NVM_IS_24_15_OR_ABOVE=1
+    fi
+    local NVM_IS_25_OR_ABOVE
+    NVM_IS_25_OR_ABOVE=0
+    if [ $NVM_IS_24_15_OR_ABOVE -eq 1 ] && nvm_version_greater_than_or_equal_to "${NODE_VERSION}" 25.0.0; then
+      NVM_IS_25_OR_ABOVE=1
+    fi
+    local NVM_IS_26_OR_ABOVE
+    NVM_IS_26_OR_ABOVE=0
+    if [ $NVM_IS_25_OR_ABOVE -eq 1 ] && nvm_version_greater_than_or_equal_to "${NODE_VERSION}" 26.0.0; then
+      NVM_IS_26_OR_ABOVE=1
+    fi
 
     if [ $NVM_IS_4_4_OR_BELOW -eq 1 ] || {
       [ $NVM_IS_5_OR_ABOVE -eq 1 ] && nvm_version_greater 5.10.0 "${NODE_VERSION}"; \
@@ -734,6 +759,13 @@ nvm_install_latest_npm() {
     ; then
       nvm_echo '* `npm` `v10.x` is the last version that works on `node` `< v20.17`, `v21`, or `v22.0` - `v22.8`'
       $NVM_NPM_CMD install -g npm@10
+    elif \
+      [ $NVM_IS_22_22_2_OR_ABOVE -eq 0 ] \
+      || { [ $NVM_IS_23_OR_ABOVE -eq 1 ] && [ $NVM_IS_24_15_OR_ABOVE -eq 0 ]; } \
+      || { [ $NVM_IS_25_OR_ABOVE -eq 1 ] && [ $NVM_IS_26_OR_ABOVE -eq 0 ]; } \
+    ; then
+      nvm_echo '* `npm` `v11.x` is the last version that works on `node` `< v22.22.2`, `v23`, `v24.0` - `v24.14`, or `v25`'
+      $NVM_NPM_CMD install -g npm@11
     else
       nvm_echo '* Installing latest `npm`; if this does not work on your node version, please report a bug!'
       $NVM_NPM_CMD install -g npm
@@ -2971,8 +3003,8 @@ nvm_compare_checksum() {
 
   if [ -z "${COMPUTED_SUM}" ]; then
     nvm_err "Computed checksum of '${FILE}' is empty." # missing in raspberry pi binary
-    nvm_err 'WARNING: Continuing *without checksum verification*'
-    return
+    nvm_err 'Refusing to continue *without checksum verification*'
+    return 1
   elif [ "${COMPUTED_SUM}" != "${CHECKSUM}" ] && [ "${COMPUTED_SUM}" != "\\${CHECKSUM}" ]; then
     nvm_err "Checksums do not match: '${COMPUTED_SUM}' found, '${CHECKSUM}' expected."
     return 1
@@ -3884,6 +3916,12 @@ nvm_download_artifact() {
     return 4
   fi
 
+  # nothing can be verified without a checksum tool, so fail before touching the cache or downloading
+  if ! nvm_get_checksum_binary >/dev/null; then
+    nvm_err 'Install one of them so that nvm can verify downloads.'
+    return 6
+  fi
+
   local CHECKSUM
   CHECKSUM="$(nvm_get_checksum "${FLAVOR}" "${TYPE}" "${VERSION}" "${SLUG}" "${COMPRESSION}")"
 
@@ -3909,7 +3947,7 @@ nvm_download_artifact() {
     fi
     nvm_compare_checksum "${TARBALL}" "${CHECKSUM}"
     nvm_err "Checksum check failed!"
-    nvm_err "Removing the broken local cache..."
+    nvm_err "Removing the unverified local cache..."
     command rm -rf "${TARBALL}"
   fi
   # `--offline` uses the cached archive without a checksum, so only a verified archive may ever sit at ${TARBALL}

test/fast/Unit tests/nvm_compare_checksum

@@ -33,9 +33,9 @@ EXPECTED_OUTPUT='Provided checksum to compare to is empty.'
 
 try_err nvm_compare_checksum ../../../nvm.sh checksum
 EXPECTED_OUTPUT="Computed checksum of '../../../nvm.sh' is empty.
-WARNING: Continuing *without checksum verification*"
+Refusing to continue *without checksum verification*"
 [ "${CAPTURED_STDERR}" = "${EXPECTED_OUTPUT}" ] || die "expected >${EXPECTED_OUTPUT}<, got >${CAPTURED_STDERR}<"
-[ "${CAPTURED_EXIT_CODE}" = 0 ] || die "expected to exit with code 0, got ${CAPTURED_EXIT_CODE}"
+[ "${CAPTURED_EXIT_CODE}" = 1 ] || die "expected to exit with code 1, got ${CAPTURED_EXIT_CODE}"
 
 nvm_compute_checksum() {
   echo "not checksum: ${1}"

test/fast/Unit tests/nvm_download_artifact only caches verified archives

@@ -4,7 +4,7 @@ WORK="${TMPDIR:-/tmp}/nvm_download_artifact_cache.$$"
 
 cleanup () {
   command rm -rf "${WORK}"
-  unset -f cleanup die download_offline nvm_get_mirror nvm_binary_available nvm_get_download_slug nvm_get_artifact_compression nvm_cache_dir nvm_get_checksum nvm_version_greater_than_or_equal_to nvm_download nvm_compare_checksum
+  unset -f cleanup die download_offline nvm_get_mirror nvm_binary_available nvm_get_download_slug nvm_get_artifact_compression nvm_cache_dir nvm_get_checksum nvm_version_greater_than_or_equal_to nvm_download nvm_compute_checksum nvm_compare_checksum nvm_get_checksum_binary
 }
 die () { echo "$@" ; cleanup ; exit 1; }
 
@@ -57,6 +57,22 @@ try download_offline
 [ "${CAPTURED_EXIT_CODE}" = '4' ] || die "empty checksum: expected --offline to find no cached archive (exit code 4), got ${CAPTURED_EXIT_CODE}"
 nvm_get_checksum() { nvm_echo 'fake_checksum'; }
 
+# a download whose checksum cannot be computed has not been verified, so it must not be accepted either
+# (this still uses the real `nvm_compare_checksum`, so it runs before that is mocked)
+nvm_compute_checksum() { nvm_echo ''; }
+try nvm_download_artifact node binary std v20.0.0
+[ "${CAPTURED_EXIT_CODE}" = '6' ] || die "unverifiable checksum: expected exit code 6, got ${CAPTURED_EXIT_CODE}"
+[ ! -e "${TEST_CACHE_DIR}" ] || die "unverifiable checksum: expected ${TEST_CACHE_DIR} to be removed"
+try download_offline
+[ "${CAPTURED_EXIT_CODE}" = '4' ] || die "unverifiable checksum: expected --offline to find no cached archive (exit code 4), got ${CAPTURED_EXIT_CODE}"
+
+# nor may a cached archive whose checksum cannot be computed be used
+command mkdir -p "${TEST_CACHE_DIR}"
+nvm_echo 'cached' > "${TEST_TARBALL}"
+try nvm_download_artifact node binary std v20.0.0
+[ "${CAPTURED_EXIT_CODE}" = '6' ] || die "unverifiable cached archive: expected exit code 6, got ${CAPTURED_EXIT_CODE}"
+[ ! -e "${TEST_CACHE_DIR}" ] || die "unverifiable cached archive: expected ${TEST_CACHE_DIR} to be removed"
+
 # a download that fails its checksum must not be left in the cache either
 nvm_compare_checksum() { return 1; }
 try nvm_download_artifact node binary std v20.0.0
@@ -76,4 +92,11 @@ try nvm_download_artifact node binary std v20.0.0
 [ ! -e "${TEST_TARBALL}.unverified" ] || die 'verified download: expected no unverified download to remain in the cache'
 [ ! -e "${WORK}/downloaded-to-final-name" ] || die 'an unverified download was written to the final cache name, where an interrupted download would be left for --offline'
 
+# without any checksum tool, nothing is downloaded and the verified cache is left alone
+nvm_get_checksum_binary() { return 1; }
+try nvm_download_artifact node binary std v20.0.0
+[ "${CAPTURED_EXIT_CODE}" = '6' ] || die "no checksum tool: expected exit code 6, got ${CAPTURED_EXIT_CODE}"
+[ "$(command cat "${TEST_TARBALL}")" = 'downloaded' ] || die "no checksum tool: expected the cached archive to be left alone, got >$(command cat "${TEST_TARBALL}")<"
+[ ! -e "${TEST_TARBALL}.unverified" ] || die 'no checksum tool: expected nothing to be downloaded'
+
 cleanup

test/fast/Unit tests/nvm_install_latest_npm

@@ -54,3 +54,30 @@ try_err nvm_install_latest_npm
 
 EXPECTED="Unable to obtain npm version."
 [ "${CAPTURED_STDERR}" = "${EXPECTED}" ] || die "When node is system and npm is unavailable, expected >${EXPECTED}<; got >${CAPTURED_STDERR}"
+
+nvm_ls_current() {
+  node --version
+}
+node() {
+  echo "${TEST_NODE_VERSION}"
+}
+npm() {
+  case "${1-}" in
+    --version) echo '10.9.0' ;;
+    *) echo "npm $*" ;;
+  esac
+}
+for TEST_NODE_VERSION in v21.7.3 v22.8.0; do
+  OUTPUT="$(nvm_install_latest_npm | grep 'install -g')"
+  [ "${OUTPUT}" = 'npm install -g npm@10' ] || die "on node ${TEST_NODE_VERSION}, expected npm@10; got >${OUTPUT}<"
+done
+
+for TEST_NODE_VERSION in v20.17.0 v22.9.0 v22.22.1 v23.0.0 v24.14.1 v25.0.0; do
+  OUTPUT="$(nvm_install_latest_npm | grep 'install -g')"
+  [ "${OUTPUT}" = 'npm install -g npm@11' ] || die "on node ${TEST_NODE_VERSION}, expected npm@11; got >${OUTPUT}<"
+done
+
+for TEST_NODE_VERSION in v22.22.2 v24.15.0 v26.0.0; do
+  OUTPUT="$(nvm_install_latest_npm | grep 'install -g')"
+  [ "${OUTPUT}" = 'npm install -g npm' ] || die "on node ${TEST_NODE_VERSION}, expected the latest npm; got >${OUTPUT}<"
+done