Skip to content

Integrity and Verification

Mechanics live on the Integrity system page.

Where it comes from

A sha256sums line is the recipe's tamper-evident seal: it turns the tarball into a parcel sealed with wax, and the promise is "what you open will be what I sealed". The integrity family is about breaking that promise in a way that still looks intact - the seal was lifted, the contents swapped, and the wax pressed back on.

The rules cover the ways the seal is defeated: SKIP and placeholder sums, sums generated by the build itself, md5sums/sha1sums where a stronger algorithm belongs, and the source URL mutating after verification. Each one means the same thing: the thing that gets built is not vouched for by the recipe at all.

This is why the checksum rules sit close to the fetch rules in importance: an unverified source makes fetch-and-execute far more dangerous, because the reviewer can no longer reason about what was fetched.

What a finding means

  • The finding says the verification is defeated or absent, and where. A SKIP or a freshly-computed sum means the tarball's contents are not vouched for by the recipe at all.
  • Integrity findings are strong amplifiers: a weakened checksum beside a dynamic source is a much higher risk than either alone.
  • Weak-algorithm findings are about hygiene meeting a real bar; read them as "this verification will not stop a substitution".

See also