fix(vendor): accept sha1-only SRI as last-resort verification in registry_fetch#134
Open
Mikola Lysenko (mikolalysenko) wants to merge 1 commit into
Open
fix(vendor): accept sha1-only SRI as last-resort verification in registry_fetch#134Mikola Lysenko (mikolalysenko) wants to merge 1 commit into
Mikola Lysenko (mikolalysenko) wants to merge 1 commit into
Conversation
…stry_fetch npm-era lockfile entries carry ONLY `integrity sha1-…` (yarn classic writes them for packages published before sha512 metadata existed). verify_sri ranked sha512/384/256 and refused everything else, so every legacy package became unvendorable whenever the prebuilt-artifact service missed and the local-build fallback fetched the pristine tarball: `vendor_fetch_failed: no usable hash in SRI sha1-…`. A clean vendored run on a real 2019-era monorepo failed 14 of 62 packages this way (ansi-regex@3.0.0, decode-uri-component@0.2.0, semver@5.3.0, …). sha1 now ranks BELOW sha256/384/512 (never preferred, only used when it is all the lockfile records) — the same trust the package manager itself enforces for those entries, and the same decision the LockIntegrity::Sha1Hex bare-hex arm already made in this file. New unit test pins: sha1-only verifies, sha1 mismatch refuses (not fail-open), sha1 never outranks a stronger hash in multi-hash SRIs, md5 still refused. Validated end-to-end on the real monorepo: all 14 previously-failing packages vendor, scan exits success, yarn 1 installs 62/62 vendored packages byte-identical to their patched blobs. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Mikola Lysenko (mikolalysenko)
enabled auto-merge (squash)
July 24, 2026 20:01
Wenxin Jiang (Wenxin-Jiang)
approved these changes
Jul 24, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The regression
A clean
scan --mode vendoredrun on a real 2019-era yarn-classic monorepo (strapi 3.6.8) failed 14 of 62 patchable packages withvendor_fetch_failed: no usable hash in SRI 'sha1-…'— all npm-era packages whose lockfile entries carry only legacyintegrity sha1-…(ansi-regex@3.0.0,decode-uri-component@0.2.0,semver@5.3.0,path-to-regexp@0.1.7, …).verify_sri(registry_fetch, #115) ranks sha512/384/256 and refuses everything else. The path only triggers when the prebuilt-artifact service misses (e.g. freshly rotated patch UUIDs) and the local-build fallback fetches the pristine registry tarball — which is why earlier runs, served entirely from the service, never hit it.The fix
sha1joins the ranking at the bottom — never preferred over sha256+, used only when it's all the lockfile records. That's the exact guarantee the package manager itself enforces for those entries, and the same trust decision theLockIntegrity::Sha1Hexbare-hex arm already made in this file.md5/unknown algos stay refused.Tests
New unit test pins all four properties: sha1-only verifies; sha1 mismatch refuses (not fail-open); sha1 never outranks a stronger hash in multi-hash SRIs (wrong-sha512 + right-sha1 fails, right-sha512 + wrong-sha1 passes); md5 still refused.
End-to-end validation (real monorepo)
Rebuilt and re-ran the clean vendored flow on the strapi repo: all 14 previously-failing packages now vendor (
scanexitssuccess, 62 wired lockfile entries), andyarn@1.22.22 installdelivers 62/62 packages byte-identical to their patched blobs.🤖 Generated with Claude Code