3 ms·
Where do you initially get the magical sha384 hash that proves the integrity of the package the first time it's imported?
by HumanOstrich 2y ago
Where do you initially get the magical sha384 hash that proves the integrity of the package the first time it's imported?
- 8n4vidtmkvmk 2y agoSame way we do in JS-land: https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity#tools_for_generating_sri_hashes https://developer.mozilla.org/en-US/docs/Web/Security/Subres... tl;dr use `openssl` on command-line to compute the hash. Ideally, any package repositories ought to publish the hash for your convenience. This of course does nothing to prove that the package is safe to use, just that it won't change out from under your nose.