What
Files a marketplace plugin pulls down are now streamed directly into the cache and hashed on the way in, instead of first landing in a temporary staging directory. The expected checksum is still verified at the end, and a download that is too large fails rather than filling the cache.
Details
- The write refuses to overwrite an existing entry and uses file mode 384 (owner read/write only) with a size cap.
- If two sessions fetch the same asset at once, the loser re-checks the digest of what is already there and treats it as a cache hit.
- Storage failures are reported as
asset_transientorasset_too_large.
Evidence
asset-cache
Strings lifted out of the shipped bundle, so the claim above can be checked against them.