Same way we do in JS-land: https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity#tools_for_generating_sri_hashes https://developer.mozilla

Same way we do in JS-land: https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity#tools_for_generating_sri_hashes https://developer.mozilla.org/en-US/docs/Web/Security/Subres... tl;dr use `openssl` on command-line to compute the hash. Ideally, any package repositories ought to publish the hash for your convenience. This of course does nothing to prove that the package is safe to use, just that it won't change out from under your nose.