fix(checksum): support artifact bundle index files - #10373
Open
agisilaos wants to merge 1 commit into
Open
Conversation
What changed: - Accept .artifactbundleindex files as checksum-only binary artifacts. - Add unit and CLI regression coverage and document exact-byte hashing. Why: - Artifact bundle indices require a checksum for manifest use, but compute-checksum only accepted extractable archive formats. Alternatives considered: - Adding artifactbundleindex to UniversalArchiver was rejected because index files are JSON and cannot be extracted.
agisilaos
requested review from
bkhouri,
bripeticca,
cmcgee1024,
daveinglis,
daveyc123,
dschaefer2,
jakepetroules,
owenv,
plemarquand and
rconnell9
as code owners
August 4, 2026 07:44
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes: #9219
Summary
Allow
swift package compute-checksumto compute checksums for.artifactbundleindexfiles.SwiftPM already accepts artifact bundle index URLs for remote binary targets and validates downloaded indices using the checksum of their exact bytes. However, the command used to produce that checksum only accepted extractable archive formats.
Changes
.artifactbundleindexas a checksum-only binary artifact format..artifactbundleindexin unsupported-file-type diagnostics.swift package compute-checksum.Alternatives considered
Adding
.artifactbundleindextoUniversalArchiverwas rejected because artifact bundle indices are JSON files and cannot be extracted.Special-casing the extension directly in the command was also considered. Keeping the behavior in the shared binary-artifact checksum helper avoids duplicating checksum logic and keeps the helper aligned with all supported binary artifact files.
Notes
The index contents are hashed exactly as written. SwiftPM does not parse, normalize, or re-encode the JSON before computing the checksum.
Archive validation and extraction behavior remain unchanged.
Testing
swift test --skip-build --filter 'WorkspaceTests.testArtifactChecksum|SwiftPMTests.packageComputeChecksumArtifactBundleIndex'PackageManagerDocsdocumentation successfully with DocCgit diff --check