{"version":"2.1.269","anchor":"artifact-publish-gains-an-internal-source-sha256-verificatio","canonical_anchor":"artifact-publish-gains-an-internal-source-sha256-verificatio","heading":"Artifact publish gains an internal source-sha256 verification path","tier":"internal","area":"Artifacts","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.269\/e\/artifact-publish-gains-an-internal-source-sha256-verificatio","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.269","markdown":"### Artifact publish gains an internal source-sha256 verification path\n\nArtifact publishing can now verify a source file's bytes against a given SHA-256 hash before publishing\n\n**What**\n\nThe artifact-publish tool now supports an internal `publishSourceSha256` field. When present, it checks the source file's actual bytes against that hash and throws a `source_unverified` error if they don't match. This applies both to sources pinned by network location and to on-disk files; for on-disk files, a symlink as the final path element also now forces `source_unverified`.\n\n**Why**\n\nThis prevents publishing an artifact whose source content doesn't match what was expected, including cases where a symlink might otherwise substitute unexpected content.\n\n- Area: Artifacts\n- Tier: Under the hood\n- Useful: 2\/5\n- Signal: 2\/5"}