Use shared integrity verification

[andrew]

Use github.com/git-pkgs/integrity for cached artifact verification. Parse expected metadata before serving, calculate the required algorithms in one pass, keep content hash and native SRI reporting separate, and discard cache records with malformed integrity values.

[Copilot]

Pull request overview

This PR migrates cached artifact integrity verification to the shared github.com/git-pkgs/integrity library, validating expected hash/SRI metadata up-front and using a single streaming pass to compute required digests before serving cached artifacts.

Changes:

• Replaced custom SRI parsing + hashing with integrity.Reader and a unified integrityChecks wrapper.
• Added early rejection/eviction of cache records with malformed content_hash or integrity metadata.
• Updated handler/database tests and fixtures to use real SHA-256 hex hashes and valid SRI strings; added the new module dependency.

Reviewed changes

Copilot reviewed 8 out of 9 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
internal/handler/integrity.go	Introduces integrityChecks and shared streaming verification via github.com/git-pkgs/integrity.
internal/handler/integrity_test.go	Updates tests to exercise new parsing/verification behaviors and mismatch messaging.
internal/handler/handler.go	Rejects unusable cache records before serving; wraps cached reads with shared integrity verification.
internal/handler/handler_test.go	Adjusts cache-hit expectations and adds coverage for rejecting malformed integrity metadata.
internal/handler/download_test.go	Updates seeded cached artifacts to use SHA-256 hex content hashes.
internal/handler/container_test.go	Updates ETag expectations to match SHA-256 hex hashes.
internal/database/database_test.go	Replaces placeholder hashes/integrity strings with realistic values in CRUD tests.
go.mod	Adds github.com/git-pkgs/integrity v0.1.0.
go.sum	Adds checksums for github.com/git-pkgs/integrity v0.1.0.

Suppressed comments (2)

internal/handler/handler.go:264

• rejectUnusableCacheRecord records an integrity failure metric using artifact.Ecosystem without normalization. For consistency with other metrics labeling (e.g. recordCacheHit), normalize the ecosystem before emitting the metric to avoid label drift.

func (p *Proxy) rejectUnusableCacheRecord(artifact *database.CachedArtifact, versionPURL, filename string, cause error) {
	p.Logger.Warn("cached artifact has unusable integrity metadata",
		"purl", versionPURL, "filename", filename,
		"path", artifact.StoragePath, "error", cause)
	metrics.RecordIntegrityFailure(artifact.Ecosystem)
	if err := p.DB.ClearArtifactCache(versionPURL, filename); err != nil {
		p.Logger.Warn("failed to clear unusable artifact from cache", "error", err)
	}

internal/handler/handler.go:219

• metrics.RecordIntegrityFailure is labeled with artifact.Ecosystem, which may not be normalized (unlike RecordCacheHit, which uses purl.NormalizeEcosystem). This can split integrity-failure metrics across multiple label variants for the same ecosystem.

This issue also appears on line 257 of the same file.

		func(reason string) {
			p.Logger.Error("cached artifact failed integrity check",
				"purl", versionPURL, "filename", filename,
				"path", artifact.StoragePath, "reason", reason)
			metrics.RecordIntegrityFailure(artifact.Ecosystem)
			if err := p.DB.ClearArtifactCache(versionPURL, filename); err != nil {

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.