tree 9d0ae231f3678aace5a6ad99f420140f821f417f
parent 817e61d9eb174f77dfd2cb1d1de45826f66ac6bf
author Sigurd Meldgaard <sigurdm@google.com> 1666095374 +0200
committer GitHub <noreply@github.com> 1666095374 +0200
gpgsig -----BEGIN PGP SIGNATURE-----
 
 wsBcBAABCAAQBQJjTpkOCRBK7hj4Ov3rIwAATr4IAJw6n8M/XR9YNnLw4tNv7t2r
 3JroJOwdzmt9KMiBrqRsu6lgXofMkATDOpZuqOyRe+YSuKeyxbfudLgvqrWBvcGi
 enRRLIvtHiJMmERIufaFAMtrmqKH7QKBZjK3qhv49bMoAKkGO6JuAz/0vwz0BUDw
 a0fI1v3QqFVA5WsI+gdpZuaSM4ePbZ8XI76/6ZnFKVr5l0y6MF5Di15FOHx2CA0T
 sNmTK9jkSumNLjjh1rLx5PYzYwQgcgU71XOBnHYfmaluGNuflv5cf1mH1wRS5mi0
 Bq5VFyfZ+2UEBHqz69wwH9OIleXi8n5s27tDrusJFupK7hFZN1DU4lm1NuE1lkg=
 =uupg
 -----END PGP SIGNATURE-----
 

Content hashing of archives (#3482)

Compute a hash of each downloaded archive and store it in: $PUB_CACHE/hosted/<hosted-url>/.hashes/<package>-<version>.sha256 (details here still subject to change)

New optional field in the package listing api for the server to provide the content-hash. If that is provided - it is verified against the downloaded archive.

When writing a pubspec.lock file, the sha256 is included in the description of each hosted package.

On pub get If the description of a package from pubspec.lock doesn't match the one in the cache, the archive is redownloaded - if the hash still doesn't match, the resolution fails with an error.

Has been moved to a follow-up PR Introduce a new option dart pub get --enforce-lockfile A mode that will NOT modify pubspec.lock. That means:

won't add hashes if missing,
will refuse to resolve if pubspec.yaml isn't satisfied,
will refuse to resolve if hashes don't match cached hashes.
will refuse to resolve if pubspec.lock is missing
will verify that the extracted package content matches the contents of the original archive.
This is useful when deploying to production.
Fixes: dart pub get --pristine/--locked #2890 and locked option in pubspec.yaml #2905

An unfortunate side-effect of this change is that all already downloaded packages will be re-downloaded (because we don't store the archives, only the extracted files) to compute their hashes.