mjhjmtu

I create a .tgz/tarball with $(npm pack).

I then run:

sha1sum oresoftware-npp-0.0.1001.tgz 

and I get:

77c58da68593dcdcd14bb16a37f5f63ef42bab63 oresoftware-npp-0.0.1001.tgz

I want to compare that shasum against another tarball on a remote server.
I can query for a shasum for a tarball on the NPM registry, with:

 npm view @oresoftware/npp@latest dist.shasum

which yields:

3c2e7328110ba57e530c9938708b35bde941c419

this shasum is different than the other one above, but that's expected, since I changed the contents of the .tgz tarball file.

my question is 3 fold:

1. When I generated a sha1sum of the .tgz file resulting from npm pack, is that the right way to do it? To generate the sha1sum after the tar file is created?




2. I assume that the the sha1sum would be identical if the tarballs had identical contents? Would they differ if the files were created/modified at different times even if they have otherwise the same contents?




3. Is there a better way to check if two tarballs have the same contents? That's all I am trying to do.

The checksums available from the NPM registry provide two features: they allow you to verify that your download hasn’t been corrupted, and if you can verify the checksums out of band, that the downloaded files haven’t been altered. Unless NPM archives are built reproducibly, the checksums don’t allow you to verify that an archive you build yourself using npm pack contains what it’s supposed to.

The issue with tarballs is that they contain metadata: the ownership, permissions and timestamps of the stored files, as stored by tar, and on top of that, compression metadata. If values for all of these are pre-agreed, they can be specified to override the values obtained from the file system, but that requires pre-agreement.

To compare the contents of two arbitrary tarballs, the only reliable way is to extract their contents and compare that.

Whether this checksum comparison is useful for you depends on what tar command you are using and that tar archive type is used.

star e.g. includes all three time stamps since 1986 and this causes tar archives to differ even with the same content, as the last acess time differs.

With the new POSIX tar enhancements from 2001, there are also all three time stamps - depending on whether the tar implementation implements the original standard or the later change.

If you don't care about time stamps, comparing archive checksums is not the right way to go.

Comparing two tar archives and making statements from that is thus usually impossible.

If you however may unpack one of the two archives, there is a nice way to compare content and meta data with a configurable set of meta data that is used for the comparison. Use star -diff, see http://schilytools.sourceforge.net/man/man1/star.1.html

If you e.g. call:

star -diff -v diffopts=!times < archive.tar.gz

the file content and all meta data except for all time stamps is compared.