javascript - What is the integrity property inside yarn.lock file? - Stack Overflow

admin管理员组

文章数量:1188020

For some reason, the command yarn is modifying the file yarn.lock with a new property to every dependency: integrity.

Git diff:

+integrity sha1-zgBCgEX7t9AxwWp7+DV4nxU2arI=

I couldn't find documentation about it so my question is - What is it?

For some reason, the command yarn is modifying the file yarn.lock with a new property to every dependency: integrity.

Git diff:

+integrity sha1-zgBCgEX7t9AxwWp7+DV4nxU2arI=

I couldn't find documentation about it so my question is - What is it?

• javascript
• yarnpkg
• yarn-lock.json

Share Improve this question Follow edited Nov 29, 2018 at 21:27 tk421 5,94766 gold badges2626 silver badges3636 bronze badges asked Nov 29, 2018 at 13:43 Stav AlfiStav Alfi 13.9k2727 gold badges108108 silver badges196196 bronze badges 2

• try this: github.com/yarnpkg/yarn/issues/2979 – gonephishing Commented Nov 29, 2018 at 15:13
• It's the product of a SHA512 hash, converted to binary, and encoded in base64: sha512sum <tarball> | awk '{ print $1 }' | xxd -r -p | base64 -w 88 – chb Commented May 9, 2023 at 20:35

Add a comment  | 

2 Answers 2

Sorted by: Reset to default 15

That is used to detect whether the files have changed since the author originally published them. If the SHA hashes don't match because of file modifications, the integrity check fails.

The author pushes their code to a repository, and this field is used to make sure that what the repository sends out is identical to what the author produced.

The idea of an integrity field is described here: https://w3c.github.io/webappsec-subresource-integrity/#resource-integrity

the integrity was used to verify that versions and hashed values of the package contents in the project’s package.json match those in yarn’s or package's lock file. This helps to verify that the package dependencies have not been altered.

you can check this in yarn check --integrity

本文标签： javascriptWhat is the integrity property inside yarnlock fileStack Overflow