install: warn when a registry manifest advertises an integrity hash bun cannot use - #38484
Open
robobun wants to merge 3 commits into
Open
install: warn when a registry manifest advertises an integrity hash bun cannot use#38484robobun wants to merge 3 commits into
robobun wants to merge 3 commits into
Claude / Claude Code Review
completed
Aug 14, 2026 in 14m 31s
Code review found 1 potential issue
Found 1 candidates, confirmed 1. See review comments for details.
Details
| Severity | Count |
|---|---|
| 🔴 Important | 0 |
| 🟡 Nit | 1 |
| 🟣 Pre-existing | 0 |
| Severity | File:Line | Issue |
|---|---|---|
| 🟡 Nit | src/install/npm.rs:2609-2622 |
Malformed dist.integrity sibling still installs unverified with no warning |
Annotations
Check warning on line 2622 in src/install/npm.rs
claude / Claude Code Review
Malformed dist.integrity sibling still installs unverified with no warning
The sibling case 6 lines above — a non-empty malformed `dist.integrity` with no (or empty) `dist.shasum` — still falls through to `Tag::UNKNOWN` and installs unverified with nothing on stderr. `Integrity::parse` returns UNKNOWN (not `Err`) on every failure path, so `is_supported()` is false and we don't `break 'integrity`; the `shasum` block is then skipped (absent) or hits the `Ok(UNKNOWN)` arm (empty), never the new `Err` arm. The `bun.lock.rs` precedent this PR cites already guards this with
Loading