From function getSHA1OfBranch:

From function getSHA1OfBranch:

        | ModuleResolver.SingleSourceFileOrigin.GitHubLink -> 
            let url = sprintf "https://api.github.com/repos/%s/%s/commits/%s" owner project branch
            let! document = lookupDocument(auth authKey url,url)
            match document with
            | Some document ->
                let json = JObject.Parse(document)
                return json.["sha"].ToString()
            | None -> 
                failwithf "Could not find hash for %s" url
                return ""

Do we want to store this sha from JSON still? Currently paket.lock looks e.g. like this:

GITHUB
  remote: zurb/bower-foundation
  specs:
    css/foundation.css (3d47a1111f1a94b594215deb41839c3ac121cb6e)
    css/normalize.css (3d47a1111f1a94b594215deb41839c3ac121cb6e)
    js/foundation.min.js (3d47a1111f1a94b594215deb41839c3ac121cb6e)

...so should there be some other hash also, calculated over the file content?

Originally posted by @Thorium in https://github.com/fsprojects/Paket/issues/1104#issuecomment-154368944

Start by locating getSHA1OfBranch and examining how its returned SHA is written into paket.lock. Compare the current GitHub commit SHA with the question about a content-derived hash, then determine the intended lock-file behavior and how completion would be verified; the issue does not name a test.