Pin the checksum in every package manager manifest

How to do it

Most users install with a package manager, which checks the hash in the manifest before it installs. A manifest edited by hand drifts from the release, or points at a "latest" URL whose file changes. Take the hashes from the checksum file in Publish a checksum and a signature with every download. Homebrew formulas carry a sha256 line, and winget manifests an InstallerSha256 field. Registries such as npm and PyPI store their own hashes, so publish there as Publish your packages without stored tokens says.

Examples

Plain text example

class Example < Formula
  desc "Command-line tool for Example Shop"
  homepage "https://example.com/cli"
  url "https://github.com/example-shop/cli/releases/download/v2.4.0/example-2.4.0.tar.gz"
  sha256 "3f786850e387550fdab836ed7e6dc881de23001b6d1f7d7a3e1bb7e4c8a3d4a2"
end

Python example

import re
from pathlib import Path

def manifest_hashes_match(sums_file: Path, manifests: list[Path]) -> bool:
    published = {line.split()[0] for line in sums_file.read_text().splitlines() if line}
    pattern = re.compile(r'(?:sha256 "|InstallerSha256: )([0-9a-fA-F]{64})')
    for manifest in manifests:
        found = pattern.findall(manifest.read_text())
        if not found or any(digest.lower() not in published for digest in found):
            return False
    return True

How to check

For the latest release, every manifest's hash equals the matching line in SHA256SUMS, and every URL contains the release tag. A test installs the tool in a clean container with each package manager, and example --version prints the release version.

Sources

• Microsoft, create your package manifest

Related rules

• DEV-18 Publish a checksum and a signature with every download in Developer tools, SDKs and CLIs
• OSS-46 Publish your packages without stored tokens in Open source maintenance