Package integrity verification via hash publication
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 1k
- Forks
- 1.3k
- Avg merge
- 2d 22h
- Merged PRs (30d)
- 189
Description
Description
Since tarball's hashes are supposed to be stable, it would be great if the hashes of these tarballs (or unpacked contents) were published. Either in https://packages.typst.org/preview/index.json or somewhere else.
- To confirm that what we receive is what was published
- To confirm that once downloaded, that the packages remain the same throughout the time there are in the cache directory.
I wouldn't really expect this to be checked every time a typst document is built, but would be nice to be able to verify.
My first thought of getting the hash of the unpacked contents was to recursively hash the contents of the package repo itself. But that is not quite valid as publishing seems to prune files. Which I guess I could replicate, but it seems like publishing integrity hashes for each package itself is a worthwhile feature.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by examining the published packages at packages.typst.org/preview/index.json and how package tarballs are stored in the cache directory. Clarify whether integrity data covers tarballs or unpacked contents, and account for the files removed during publishing. Done means the publication location, hash scope, and verification behavior are agreed and documented.
Written by the indexing model from the issue text.
Assessment
- Domain
- security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100