<story><title>Git archive checksums may change</title><url>https://github.blog/changelog/2023-01-30-git-archive-checksums-may-change/</url></story><parent_chain><item><author>vtbassmatt</author><text>Hey folks. I&amp;#x27;m the product manager for Git at GitHub. We&amp;#x27;re sorry for the breakage, we&amp;#x27;re reverting the change, and we&amp;#x27;ll communicate better about such changes in the future (including timelines).&lt;p&gt;Also posted here: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;bazel-contrib&amp;#x2F;SIG-rules-authors&amp;#x2F;issues&amp;#x2F;11#issuecomment-1409438954&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;bazel-contrib&amp;#x2F;SIG-rules-authors&amp;#x2F;issues&amp;#x2F;11...&lt;/a&gt;</text></item></parent_chain><comment><author>rsc</author><text>Thanks for the quick rollback.&lt;p&gt;I want to encourage you to think about locking in the current archive details, at least for archives that have already been served. Verifying that downloaded archives have the expected checksum is a critical best practice for software supply chain security. Training people to ignore checksum changes is training them to ignore attacks.&lt;p&gt;GitHub is a strong leader in other parts of supply chain security, and it can lead here too. Once GitHub has served an archive with a given checksum, it should guarantee that the archive has that checksum forever.</text></comment>
<story><title>Git archive checksums may change</title><url>https://github.blog/changelog/2023-01-30-git-archive-checksums-may-change/</url></story><parent_chain><item><author>vtbassmatt</author><text>Hey folks. I&amp;#x27;m the product manager for Git at GitHub. We&amp;#x27;re sorry for the breakage, we&amp;#x27;re reverting the change, and we&amp;#x27;ll communicate better about such changes in the future (including timelines).&lt;p&gt;Also posted here: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;bazel-contrib&amp;#x2F;SIG-rules-authors&amp;#x2F;issues&amp;#x2F;11#issuecomment-1409438954&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;bazel-contrib&amp;#x2F;SIG-rules-authors&amp;#x2F;issues&amp;#x2F;11...&lt;/a&gt;</text></item></parent_chain><comment><author>mdouglass</author><text>We are seeing an npm install failure inside our docker builds pointing at a github URL with a SHA change. Is this possibly related?&lt;p&gt;&lt;pre&gt;&lt;code&gt;  #15 [dev-builder 4&amp;#x2F;7] RUN --mount=type=secret,id=npm,dst=&amp;#x2F;root&amp;#x2F;.npmrc npm ci
  #0 4.743 npm WARN deprecated querystring@0.2.0: The querystring API is considered Legacy. new code should use the URLSearchParams API instead.
  #0 8.119 npm WARN tarball tarball data for http2@https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;node-apn&amp;#x2F;node-http2&amp;#x2F;archive&amp;#x2F;apn-2.1.4.tar.gz (sha512-ad4u4I88X9AcUgxCRW3RLnbh7xHWQ1f5HbrXa7gEy2x4Xgq+rq+auGx5I+nUDE2YYuqteGIlbxrwQXkIaYTfnQ==) seems to be corrupted. Trying again.
  #0 8.164 npm ERR! code EINTEGRITY
  #0 8.169 npm ERR! sha512-ad4u4I88X9AcUgxCRW3RLnbh7xHWQ1f5HbrXa7gEy2x4Xgq+rq+auGx5I+nUDE2YYuqteGIlbxrwQXkIaYTfnQ== integrity checksum failed when using sha512: wanted sha512-ad4u4I88X9AcUgxCRW3RLnbh7xHWQ1f5HbrXa7gEy2x4Xgq+rq+auGx5I+nUDE2YYuqteGIlbxrwQXkIaYTfnQ== but got sha512-GWBlkDNYgpkQElS+zGyIe1CN&amp;#x2F;XJxdEFuguLHOEGLZOIoDiH4cC9chggBwZsPK&amp;#x2F;Ls9nPikTzMuRDWfLzoGlKiRw==. (72989 bytes)
  #0 8.176 
  #0 8.177 npm ERR! A complete log of this run can be found in:
  #0 8.177 npm ERR!     &amp;#x2F;root&amp;#x2F;.npm&amp;#x2F;_logs&amp;#x2F;2023-01-30T23_19_36_986Z-debug-0.log
  #15 ERROR: process &amp;quot;&amp;#x2F;bin&amp;#x2F;sh -c npm ci&amp;quot; did not complete successfully: exit code: 1
&lt;/code&gt;&lt;/pre&gt;
This was working earlier today and the docker build&amp;#x2F;package.json haven&amp;#x27;t changed.</text></comment>