Skip to content

Integrity and Verification

Mechanics live on the Integrity system page.

Rules in this nature: C001, C002, C003, C004, C005, C008, C009, C010, C011, C013, C014, C018, C019, C020, C022, C023, C026, C027, C033, H001, H002, H005, H008, H018, H019, H024, H025, H033, H047, H066, H070, H078, H079, H087, H091, H092, H096, H097, H099, H101, H103, R049, R050, R078, R091, R099, R104 (47 rules).

Where it comes from

A sha256sums line is the recipe's tamper-evident seal: it turns the tarball into a parcel sealed with wax, and the promise is "what you open will be what I sealed". The integrity family is about breaking that promise in a way that still looks intact - the seal was lifted, the contents swapped, and the wax pressed back on.

The rules cover the ways the seal is defeated: SKIP and placeholder sums, sums generated by the build itself, md5sums/sha1sums where a stronger algorithm belongs, and the source URL mutating after verification. Each one means the same thing: the thing that gets built is not vouched for by the recipe at all.

This is why the checksum rules sit close to the fetch rules in importance: an unverified source makes fetch-and-execute far more dangerous, because the reviewer can no longer reason about what was fetched.

What a finding means

  • The finding says the verification is defeated or absent, and where. A SKIP or a freshly-computed sum means the tarball's contents are not vouched for by the recipe at all.
  • Integrity findings are strong amplifiers: a weakened checksum beside a dynamic source is a much higher risk than either alone.
  • Weak-algorithm findings are about hygiene meeting a real bar; read them as "this verification will not stop a substitution".

See also