Install Verification

When fetching a package, you VERIFY two things:

Cryptographic hash (integrity): the bytes match the lockfile's hash. Catches bit rot, MITM tampering, and accidentally-published bad versions.

sri = "sha512-AAaa..."  # subresource integrity format
download("express-4.18.0.tgz")
actual = sha512(file_contents)
assert actual == sri.split("-")[1]

If the hash doesn't match: ABORT. Don't continue with possibly-malicious code.

Signature (authenticity, optional): the publisher signed the package. Mostly missing in npm/PyPI; present in apt/dnf via GPG; getting better with sigstore + Cosign.

The two solve different problems:

• Hash verifies the bits are unchanged since the lockfile was generated
• Signature verifies the bits came from the claimed author

Real-world supply-chain attacks:

• event-stream (npm 2018): a maintainer added a malicious dep; targeted Bitcoin wallets. Hash didn't help — the hash was for the malicious version.
• leftpad (npm 2016): unpublished package broke half the JS world.
• xz (Linux 2024): backdoor inserted by a long-time contributor; hash wouldn't catch a malicious official release.

So lockfiles + hashes solve the "ensure repeatable builds" problem, NOT the "ensure code is safe" problem.