SHA1 sum of package dists should be more reliable than a SHA1 on the zip result
Open
Bug
- Dominant language
- PHP
- Stars
- 29.5k
- Forks
- 4.8k
- Avg merge
- 2d 2h
- Merged PRs (30d)
- 12
Description
(Replacing #1496 which has become a mess, references #5940)
If multiple servers create archives, then those archives can have different SHA1s which is problematic. Potential solutions:
- hash the contents in a reproducible way (might be very slow)
- just avoid recreating archives all the time (depends on ecosystem but preferable)
Contributor guide
Assessment
This issue has not been assessed yet.