Document recommendation for generating bzlmod integrity value
Open
P2
team-Documentation
team-ExternalDeps
type: documentation (cleanup)
- Dominant language
- Java
- Stars
- 25.8k
- Forks
- 4.6k
- Avg merge
- 2d 20h
- Merged PRs (30d)
- 72
Description
Currently the documentation for the `integrity` field:
> integrity: The [Subresource Integrity](https://w3c.github.io/webappsec-subresource-integrity/#integrity-metadata-description) checksum of the archive.
links to the spec of the subresource integrity format. I think ideally given the community has generally standardized on using sha256s of the archives, there should be a quick snippet recommendation folks can copy and paste to generate what they need. I guess that is something like:
```
openssl dgst -sha256 -binary ARCHIVE.tar.gz | openssl base64 -A | sed 's/^/sha256-/'
```
Contributor guide
Assessment
This issue has not been assessed yet.