Tag
trust-on-first-use
- Feb 25, 2025 What a SHA-512 Integrity Hash in Package Metadata Actually Proves Subresource Integrity, package lockfile digests, and Go checksums look alike but answer different questions about who computed the hash and what it covers. security
- Dec 9, 2024 Integrity Hashes and Registry Trust What a package digest actually covers, where it is recorded, and which attacks a lockfile digest stops and which it cannot, from republishing to dependency confusion. developer tools