Checks an archive against the digest its repository published, before anything is unpacked.
drupal.org publishes a SHA-1 for every release. Packagist publishes an empty string for a GitHub
zipball and a branch archive has none, so a package without a digest installs unverified and the
caller says so. A digest that is present and does not match always refuses, and nothing the
caller passes can waive it. The digest comes from the same repository as the archive's URL, so it
catches a swapped or corrupted archive, not a repository that lies in both.
Checks an archive against the digest its repository published, before anything is unpacked.
drupal.org publishes a SHA-1 for every release. Packagist publishes an empty string for a GitHub zipball and a branch archive has none, so a package without a digest installs unverified and the caller says so. A digest that is present and does not match always refuses, and nothing the caller passes can waive it. The digest comes from the same repository as the archive's URL, so it catches a swapped or corrupted archive, not a repository that lies in both.