Under the hoodTier: how much it should matter to you
2Useful: my rating, 1 to 5
2Signal: worth watching, 1 to 5
ArtifactsArea: what it touches
Internal ChangesKind: in v2.1.269,
Internal ChangesSection of the release
What
The artifact-publish tool now supports an internal publishSourceSha256 field. When present, it checks the source file's actual bytes against that hash and throws a source_unverified error if they don't match. This applies both to sources pinned by network location and to on-disk files; for on-disk files, a symlink as the final path element also now forces source_unverified.
Why
This prevents publishing an artifact whose source content doesn't match what was expected, including cases where a symlink might otherwise substitute unexpected content.
