Fix logical bug in checksums environment variable handling in npm/install.js

[KinshukSS2]

Preflight Checklist

• I have read the Contributing Guidelines for this project.
• I agree to follow the Code of Conduct that this project adheres to.
• I have searched the issue tracker for a bug report that matches the one I want to file, without success.

Electron Version

36.0.0 and above

What operating system(s) are you using?

Ubuntu

Operating System Version

Ubuntu 25.04

What arch are you using?

x86_64

Expected Behavior

This makes the intent clearer:
if either environment variable is truthy, skip local checksums

checksums: (process.env.electron_use_remote_checksums || process.env.npm_config_electron_use_remote_checksums) ? undefined : require('./checksums.json'),

Actual Behavior

There is a logical bug in install.js line 47 where the environment variable check for electron_use_remotechecksums doesn't work correctly due to operator precedence

The ternary operator (?:) has lower precedence than the nullish coalescing operator (??), so the code is evaluated as:

checksums: (process.env.electron_use_remote_checksums ?? process.env.npm_config_electron_use_remote_checksums) ? undefined : require('./checksums.json')

• If either variable is set to a truthy value, it uses remote checksums
• But the logic is confusing and not what was likely intended

[rishitdubey]

Can you please include the steps to regenerate the problem in my local environment.

[nikwen]

Thanks for reporting!

Just for context, this is a permalink to the line of code this refers to:

electron/npm/install.js

Line 47 in f784ea6

checksums: process.env.electron_use_remote_checksums ?? process.env.npm_config_electron_use_remote_checksums ? undefined : require('./checksums.json'),

[ckerr]

@KinshukSS2 thanks for reporting this!

I agree with the change you're suggesting. It seems to correctly implement the behavior
described in this feature's documentation:

 If your mirror serves artifacts with different checksums to the official
-Electron release you may have to set `electron_use_remote_checksums=1` to
-force Electron to use the remote `SHASUMS256.txt` file to verify the checksum
-instead of the embedded checksums.
+Electron release you may have to set `electron_use_remote_checksums=1` directly,
+or configure it in a `.npmrc` file, to force Electron to use the remote `SHASUMS256.txt`
+file to verify the checksum instead of the embedded checksums.