pnpm audit signatures fails on devEngines.runtime entries since 12.10.0: "Missing lockfile integrity for node@<version>" #16869

Verify latest release

• Reproduced on pnpm 12.11.0 (latest at the time of writing)

pnpm version

12.11.0 (regression; 12.8.2 passes on the same lockfile)

Which area(s) of pnpm are affected?

pnpm audit signatures, devEngines.runtime

Link to the code that reproduces this issue or a replay of the bug

Minimal project, no other config:

{
  "name": "repro",
  "private": true,
  "devEngines": { "runtime": { "name": "node", "version": "24.21.0", "onFail": "download" } },
  "dependencies": { "is-number": "7.0.0" }
}

Reproduction steps

1. pnpm install
2. pnpm audit signatures

Describe the Bug

On 12.11.0 the audit reports the runtime as an invalid signature and exits 1:

audited 2 packages

1 package has a verified registry signature

1 package has an invalid registry signature:

│ node@24.21.0 │ https://registry.npmjs.org/ │ Missing lockfile integrity for node@24.21.0 │

On 12.8.2, with a byte-identical lockfile, it passes: 2 packages have verified registry signatures.

The node@runtime:24.21.0 entry has resolution.type: variations with a per-platform integrity under each variant, but no top-level integrity. The 12.10.0 change that makes audit signatures verify against the lockfile's recorded integrity ("Packages without a recorded integrity cannot pass signature verification") seems to treat that as missing.

Expected Behavior

Runtime entries resolved through devEngines.runtime either verify via their per-variant integrity, or are skipped by audit signatures (they are not registry tarballs with npm signatures). As it stands, any project that pins its Node runtime via devEngines.runtime and gates CI on pnpm audit signatures cannot upgrade past 12.9.x.

Which Node.js version are you using?

24.21.0 (managed by pnpm via devEngines.runtime)

Which operating systems have you used?

• macOS
• Linux (GitHub Actions ubuntu-latest, same error)