https://nalar.dev/tags/integrity/ Recent content in Integrity on Nalar Hugo en-us Fri, 04 Sep 2026 00:00:00 +0700 https://nalar.dev/verify-dependency-integrity-before-installation/ Fri, 04 Sep 2026 00:00:00 +0700 https://nalar.dev/verify-dependency-integrity-before-installation/ <p>A dependency declaration such as <code>library = 2.4.1</code> tells a package manager which release you intend to use. It does not, by itself, prove that the bytes being installed are the same bytes you previously reviewed, tested, or approved.</p> <p>That distinction matters when dependencies cross a trust boundary. Packages may come through registries, mirrors, caches, proxies, build systems, or internal artifact stores. If unexpected bytes are accepted somewhere along that path, a familiar package name and version can create false confidence.</p>