---
title: "Pin the checksum in every package manager · Agent Wranglers"
url: https://agentwranglers.se/playbook/developer-tools/distribution/package-manager-checksums
id: DEV-19
level: Recommended
updated: 2026-10-27
build: a2a6bdfed830
tokens: 959
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Pin the checksum in every package manager manifest

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Distribution](https://agentwranglers.se/playbook/developer-tools/distribution.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: DEV-19
- Level: Recommended
- Chapter: [Distribution](https://agentwranglers.se/playbook/developer-tools/distribution.md)
- Rule: Generate each package manager manifest, such as a Homebrew formula or a winget manifest, in the release job. Each one names the download by its fixed release URL and its SHA-256.
- Check: For the latest release, every manifest's hash equals the matching line in `SHA256SUMS`, and every URL contains the release tag. A test installs the tool in a clean container with each package manager, and `example --version` prints the release version.
- How: Most users install with a package manager, which checks the hash in the manifest before it installs. A manifest edited by hand drifts from the release, or points at a "latest" URL whose file changes. Take the hashes from the checksum file in [Publish a checksum and a signature with every download](https://agentwranglers.se/playbook/developer-tools/distribution/checksums-and-signatures.md). Homebrew formulas carry a `sha256` line, and winget manifests an `InstallerSha256` field. Registries such as npm and PyPI store their own hashes, so publish there as [Publish your packages without stored tokens](https://agentwranglers.se/playbook/open-source/releases/trusted-publishing.md) says.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### Plain text example

```ruby
class Example < Formula
  desc "Command-line tool for Example Shop"
  homepage "https://example.com/cli"
  url "https://github.com/example-shop/cli/releases/download/v2.4.0/example-2.4.0.tar.gz"
  sha256 "3f786850e387550fdab836ed7e6dc881de23001b6d1f7d7a3e1bb7e4c8a3d4a2"
end
```

### Python example

```python
import re
from pathlib import Path

def manifest_hashes_match(sums_file: Path, manifests: list[Path]) -> bool:
    published = {line.split()[0] for line in sums_file.read_text().splitlines() if line}
    pattern = re.compile(r'(?:sha256 "|InstallerSha256: )([0-9a-fA-F]{64})')
    for manifest in manifests:
        found = pattern.findall(manifest.read_text())
        if not found or any(digest.lower() not in published for digest in found):
            return False
    return True
```

## Sources

- [Microsoft, create your package manifest](https://learn.microsoft.com/en-us/windows/package-manager/package/manifest)

## Related rules

- DEV-18 [Publish a checksum and a signature with every download](https://agentwranglers.se/playbook/developer-tools/distribution/checksums-and-signatures.md) in Developer tools, SDKs and CLIs
- OSS-46 [Publish your packages without stored tokens](https://agentwranglers.se/playbook/open-source/releases/trusted-publishing.md) in Open source maintenance

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/developer-tools/distribution/package-manager-checksums">Agent Wranglers developer tools, SDKs and CLIs playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Publish a checksum and a signature with every download](https://agentwranglers.se/playbook/developer-tools/distribution/checksums-and-signatures.md)
- [Distribution](https://agentwranglers.se/playbook/developer-tools/distribution.md)