ecosystem_hashes.md

Ecosystem hash/digest availability

Survey of which package registries expose a content hash (sha256, sha1, digest, integrity, checksum) for package versions, based on app/models/ecosystem/*.rb and test/fixtures/files/*.

Currently extracting hash into integrity field

Ecosystem	Source field	Algo	Code
adelie	C	apk checksum	adelie.rb
alpine	C	apk checksum	alpine.rb
bazel	source.integrity	SRI	bazel.rb
cargo	checksum	sha256 (in metadata, not integrity)	cargo.rb
conan	sources.sha256	sha256 (in metadata, not integrity)	conan.rb
cpan	checksum_sha256	sha256	cpan.rb
fdroid	hash	sha256	fdroid.rb
guix	source[0].integrity	SRI	guix.rb
hex	checksum	sha256	hex.rb
npm	dist.integrity / dist.shasum	SRI / sha1	npm.rb
postmarketos	C	apk checksum	postmarketos.rb
puppet	file_sha256	sha256	puppet.rb
pypi	digests.sha256	sha256	pypi.rb
rubygems	sha	sha256	rubygems.rb
spack	sha256	sha256	spack.rb

Hash present in registry response but not extracted

Ecosystem	Field in fixture	Algo	Fixture
deno	checksum	sha256	test/fixtures/files/deno
helm	digest	sha256	test/fixtures/files/helm
homebrew	sha256 (bottle + source)	sha256	test/fixtures/files/homebrew
julia	md5 / sha1	md5 / sha1	test/fixtures/files/julia
nuget	packageHash + packageHashAlgorithm	sha512	test/fixtures/files/nuget
openvsx	sha256	sha256	test/fixtures/files/openvsx
packagist	dist.shasum	sha1	test/fixtures/files/packagist
racket	checksum	git sha	test/fixtures/files/racket

No hash in registry response (per fixtures)

actions, bioconductor, bower, carthage, clojars, cocoapods, conda, cran, ctan, deb/debian/ubuntu, docker, elm, elpa, go, hackage, ips, maven, nixpkgs, pub, swiftpm, terraform, vcpkg

Notes

• bower: fixture hits were from an npm-style lockfile, not the bower registry itself
• conda: upstream repodata.json has sha256/md5 per artifact but our conda proxy fixtures don't include it
• deb/debian/ubuntu: Packages files contain SHA256: / MD5sum: lines but there are no fixtures and deb.rb doesn't parse them
• docker: images are content-addressed by digest but the Hub API list response we use doesn't expose them
• go: the module proxy serves .ziphash / go.sum entries, not inline in the /@v/list endpoint we fetch
• maven: publishes .sha1 / .sha256 sidecar files alongside artifacts rather than inline in maven-metadata.xml
• pub: pub.dev API now returns archive_sha256 on version entries but our fixture predates it

Tracked in ecosyste-ms/packages#1630.