checkIntegrity

tcmts.loader.packages.checkIntegrity · #tj6oedrc · term · runs on the server

uses tcmts.loader.packages.installedIntegrity, which uses node:path

A locked version means exactly one tarball: the first install records its integrity (the registry's sha512), and an install that got different bytes for the same version is refused.

import type { Layout } from "#codebase/tcmts/loader";
import { installedIntegrity } from "#codebase/tcmts/loader/packages";
import type { PackageLock } from "#codebase/tcmts/loader/packages";

export function checkIntegrity(lay: Layout, lock: PackageLock) {
  const installed = installedIntegrity(lay);
  for (const l of lock.all()) {
    const got = installed.get(`${l.name}@${l.version}`);
    if (!got) continue;
    if (!l.integrity) lock.set(l.name, l.range, l.version, got);
    else if (l.integrity !== got) {
      throw new Error(`${l.name}@${l.version}: the installed tarball (${got.slice(0, 20)}…) isn't the one this codebase locked (${l.integrity.slice(0, 20)}…); refusing to run it`);
    }
  }
}

uses

used by