Version: github.com/git-pkgs/integrity v0.1.1, github.com/git-pkgs/registries v0.7.0, and git-pkgs/proxy#260.
Proxy reads versions.integrity when serving cached artifacts. PR #260 parses that value before opening the cached object. If parsing fails, the cache record is cleared and fetched again. A valid registry checksum therefore needs to be parseable and verifiable, even when it is not W3C SRI.
registries.Version.Integrity currently contains several encodings:
Vagrant box metadata carries the algorithm and hexadecimal digest separately. Vagrant accepts MD5, SHA-1, SHA-256, SHA-384, and SHA-512.
Keep ParseSRI strict. Add parsing for a single algorithm-prefixed hexadecimal checksum without accepting MD5 or SHA-1 as SRI. ParseHex should support all five algorithms when the caller already has the algorithm separately.
Add verification-only MD5 and SHA1 algorithms:
- Calculate them in
NewReader alongside the existing algorithms.
- Validate 16-byte MD5 and 20-byte SHA-1 digests.
- Provide an exact-digest verification path for registry checksums. Keep
Result.Verify and its strongest-algorithm rule specific to SRI.
- Keep weak digests out of
ParseSRI, FormatSRI, and Digest.SRI.
- Use an explicit strength ranking rather than enum order. The current
strongestAlgorithm compares numeric algorithm values, which would be unsafe once weaker algorithms are added.
Document MD5 and SHA-1 as compatibility checks for publisher-supplied metadata. They must not be selected for newly generated integrity metadata.
Version.Integrity must describe the bytes fetched by proxy. Julia's git-tree-sha1 is a tree identity rather than a digest of the downloaded tarball, so it should remain registry metadata and stay outside streaming checksum verification.
Tests should cover hexadecimal parsing, canonical output, digest length errors, streaming calculation, successful verification, mismatches, and incomplete reads for both MD5 and SHA-1. Add regression tests proving that valid MD5 and SHA-1 base64 strings remain invalid SRI and that existing multi-hash SRI strength rules are unchanged.
Version:
github.com/git-pkgs/integrityv0.1.1,github.com/git-pkgs/registriesv0.7.0, and git-pkgs/proxy#260.Proxy reads
versions.integritywhen serving cached artifacts. PR #260 parses that value before opening the cached object. If parsing fails, the cache record is cleared and fetched again. A valid registry checksum therefore needs to be parseable and verifiable, even when it is not W3C SRI.registries.Version.Integritycurrently contains several encodings:sha256-<hex>.sha1-<hex>, while Packagist also uses SHA-1.md5-<hex>.Vagrant box metadata carries the algorithm and hexadecimal digest separately. Vagrant accepts MD5, SHA-1, SHA-256, SHA-384, and SHA-512.
Keep
ParseSRIstrict. Add parsing for a single algorithm-prefixed hexadecimal checksum without accepting MD5 or SHA-1 as SRI.ParseHexshould support all five algorithms when the caller already has the algorithm separately.Add verification-only
MD5andSHA1algorithms:NewReaderalongside the existing algorithms.Result.Verifyand its strongest-algorithm rule specific to SRI.ParseSRI,FormatSRI, andDigest.SRI.strongestAlgorithmcompares numeric algorithm values, which would be unsafe once weaker algorithms are added.Document MD5 and SHA-1 as compatibility checks for publisher-supplied metadata. They must not be selected for newly generated integrity metadata.
Version.Integritymust describe the bytes fetched by proxy. Julia'sgit-tree-sha1is a tree identity rather than a digest of the downloaded tarball, so it should remain registry metadata and stay outside streaming checksum verification.Tests should cover hexadecimal parsing, canonical output, digest length errors, streaming calculation, successful verification, mismatches, and incomplete reads for both MD5 and SHA-1. Add regression tests proving that valid MD5 and SHA-1 base64 strings remain invalid SRI and that existing multi-hash SRI strength rules are unchanged.