fix(install): store and verify SHA-512 integrity hash for GitHub tarball dependencies
Merged
RO
3mo ago+314+314+012345678901234567890123456789-4-4-0123456789
Summary
- Compute SHA-512 hash of GitHub tarball bytes during extraction and store in
bun.lock - Verify the hash on subsequent installs when re-downloading, rejecting tampered tarballs
- Automatically upgrade old lockfiles without integrity by computing and persisting the hash
- Maintain backward compatibility with old lockfile format (no integrity field)
Fixes GHSA-pfwx-36v6-832x
Lockfile format change
Before: ["pkg@github:user/repo#ref", {}, "resolved-commit"]
After: ["pkg@github:user/repo#ref", {}, "resolved-commit", "sha512-..."]
The integrity field is optional for backward compatibility. Old lockfiles are automatically upgraded when the tarball is re-downloaded.
Test plan
- Fresh install stores SHA-512 integrity hash in lockfile
- Re-install with matching hash succeeds
- Re-install with mismatched hash rejects the tarball
- Old lockfile without integrity is auto-upgraded with hash on re-download
- Cache hits still work without re-downloading
- Existing GitHub dependency tests pass (10/10)
- Existing git resolution snapshot test passes
- Yarn migration snapshot tests pass
š¤ Generated with Claude Code