add note about integrity

dart-lang · Jan 6, 2025 · 81961d7 · 81961d7
1 parent 6cdcfa5
commit 81961d7
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/pkgs/native_assets_cli/example/build/download_asset/lib/src/hook_helpers/download.dart b/pkgs/native_assets_cli/example/build/download_asset/lib/src/hook_helpers/download.dart
@@ -37,6 +37,10 @@ Future<File> downloadAsset(
 }
 
 Future<String> hashAsset(File assetFile) async {
+  // TODO(dcharkes): Should this be a strong hash to not only check for download
+  // integrity but also safeguard against tampering? This would protected
+  // against the case where the binary hoster is compromised but pub is not
+  // compromised.
   final fileHash = md5.convert(await assetFile.readAsBytes()).toString();
   return fileHash;
 }