2 days ago
- Content addressing uses cryptographic hashes to identify data, enabling integrity verification, deduplication, and tamper evidence across package management systems.
- Hashing occurs at multiple levels: individual files, single artifacts, dependency graphs, package versions, registry indices, metadata, and build inputs, each with specific use cases.
- Identical extracted content can produce different hashes due to archive metadata; solutions include canonical formats (e.g., Nix NAR) or hashing file trees directly (e.g., Go's dirhash).
- Hash function choice and encoding vary (e.g., SRI, OCI sha256, go.sum h1:), and self-describing identifiers ease migration between algorithms.
- Hashes serve verification, addressing (fetch by hash), deduplication, build caching, and tamper evidence via Merkle structures, separating trust in names from trust in data delivery.
- Trust in the name-to-hash binding is critical; supply chain attacks exploit account takeover or typo-squatting rather than the hash itself.