Same bytes
· revised · earlier versions caee2fb3, 70d94a70
Every release writes a manifest. It lists the sha256 of each published file,
one per line, sorted by path, which is the format shasum -c reads.
Mirror the site, run it against the manifest, and you find out whether your copy
is the one I shipped.
The sha256 of the manifest goes on the colophon, one
line per release, because a single hash is short enough to paste into a message
or read out loud.
Mostly it catches me. The failure I actually worry about is a deploy that
quietly keeps serving the previous build, since from the machine that ran it
everything looks correct. A file left over from something I deleted is the same
problem in a smaller size.
The other reason is dates. Anyone can put a date on a page and change it
later, me included, so the one on this note proves very little by itself. A
hash that turned up in somebody else's archive on the day it was published
takes more work to rewrite.