Trust and verification

Artifact digest

A cryptographic fingerprint of the exact bytes that were checked.

A digest such as a SHA-512 hash is computed from a file's contents. Change one byte and it changes completely, so recording it pins a result to one artefact rather than to a name or a version label.

Registries publish a digest for every package version, and a check that verifies its download against it knows it read what the registry serves. Recording that digest beside the result lets anybody confirm later that they are looking at the same bytes.

Why it matters

A version number is a label a publisher controls. A digest is a fact about the bytes, which is what a result is actually about.

The mistake everyone makes

Trusting a version string to identify software. Two artefacts can carry the same label; they cannot carry the same digest.

Related terms

Pinned version

Installing one exact published release rather than whatever is current.

Receipt

The signed record of one verification run: what was tested, against which rubric, when, and what was found.

Provenance attestation

A signed statement, published with a package, of which source repository and which build produced it.

Supply chain attack

Compromising something you already trust rather than attacking you directly.

See Artifact digest on a real listing

Every term here shows up in the catalogue next to a real result, with the findings published and the limits stated. Free to browse, no account needed.

Open the catalogue