{"action":"opened","issue":{"url":"https://api.github.com/repos/JamieMason/shrinkpack/issues/51","repository_url":"https://api.github.com/repos/JamieMason/shrinkpack","labels_url":"https://api.github.com/repos/JamieMason/shrinkpack/issues/51/labels{/name}","comments_url":"https://api.github.com/repos/JamieMason/shrinkpack/issues/51/comments","events_url":"https://api.github.com/repos/JamieMason/shrinkpack/issues/51/events","html_url":"https://github.com/JamieMason/shrinkpack/issues/51","id":162599132,"number":51,"title":"Verify shrinkpack-ed packages are the same as remote","user":{"login":"5id","id":3411140,"avatar_url":"https://avatars.githubusercontent.com/u/3411140?v=3","gravatar_id":"","url":"https://api.github.com/users/5id","html_url":"https://github.com/5id","followers_url":"https://api.github.com/users/5id/followers","following_url":"https://api.github.com/users/5id/following{/other_user}","gists_url":"https://api.github.com/users/5id/gists{/gist_id}","starred_url":"https://api.github.com/users/5id/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/5id/subscriptions","organizations_url":"https://api.github.com/users/5id/orgs","repos_url":"https://api.github.com/users/5id/repos","events_url":"https://api.github.com/users/5id/events{/privacy}","received_events_url":"https://api.github.com/users/5id/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2016-06-28T04:17:03Z","updated_at":"2016-06-28T04:17:03Z","closed_at":null,"body":"Interested on your thoughts about having the ability to run something like `shrinkpack --verify`, which would attempt to redownload the original package tgz found in the npm-shrinkwrap.json file (rather than using the local), and compare the checksums against the files in node_shrinkpack.\r\n\r\nThis would give us confidence that what is stored in the repository, matches the packages remotely. My concern arises from when people are raising PR's to check in the node_shrinkpack files, there's no way to tell if they're safe or not without manually checking the checksums yourself.\r\n\r\nIdeally once npm-shrinkwrap.json supports checksums this could all go away, and shrinkpack would continue working fine."}}
{"actor":{"display_login":"5id"}}