Skip to content

fix: set only one hash per version to "arcat" binary for compatibility with Buildbarn and SRI standard #3472

Merged
toastwaffle merged 6 commits intothought-machine:masterfrom
njskalski:fix/buildbarn-compatible-arcat-hash
Feb 4, 2026
Merged

fix: set only one hash per version to "arcat" binary for compatibility with Buildbarn and SRI standard #3472
toastwaffle merged 6 commits intothought-machine:masterfrom
njskalski:fix/buildbarn-compatible-arcat-hash

Conversation

@njskalski
Copy link
Contributor

@njskalski njskalski commented Dec 16, 2025

Buildbarn assumes that only one SHA per binary is provided, or the SHAs are of different algorithms.

To enable Buildbarn as a backend to Please, this change is necessary.

With this change, current Buildbarn works as a backend.

…thout this change, Please does not work with Buildbarn
@peterebden
Copy link
Collaborator

I'm generally happy with the approach, modulo the comments so far. One thing I do want to clarify though...

That's something the standard does NOT allow.

Actually, it does allow it. Referring to the spec, example 7 covers this case:

which would allow the user agent to accept two different content payloads, one of which matches the first SHA-384 hash value and the other matches the second SHA-384 hash value.

Although as we discussed on the issue a little while back, I agree this is a practical solution to make Please more working with the various servers out there.

@njskalski
Copy link
Contributor Author

@peterebden thanks for calling that out. I got fooled by AI.

I addressed the comments.

@njskalski njskalski requested a review from toastwaffle February 2, 2026 18:19
@toastwaffle toastwaffle merged commit 57a4e17 into thought-machine:master Feb 4, 2026
13 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants