Docs

Integrity ​

You downloaded an artifact and want proof it holds the bytes the build produced. Every artifact ships with an integrity hash, and verification runs against the bytes alone: a build can be verified without trusting the console that served it.

The integrity record ​

Each browser's build emits <browser>.integrity.json next to <browser>-extension.zip. The same record returns from the API:

GET /api/projects/{id}/builds/{buildId}/integrity/{browser}

The verifier ​

@extension.dev/artifact-integrity is public on npm, with the bin extension-artifact-integrity. It downloads an artifact, verifies the zip structure, the manifest and the metadata against the integrity record, and emits deterministic JSON: the same artifact produces the same output, byte for byte.

bash
npx @extension.dev/artifact-integrity <artifact-url>

Exit 0 means the artifact ships. Exit 1 means it does not. There is no third state.

As a CI release gate ​

The exit code is the gate. Verify before you promote, and a nonzero exit stops the job:

yaml
- run: npx @extension.dev/artifact-integrity "$ARTIFACT_URL"

Because the output is deterministic JSON, the report can also be committed or diffed across runs.

When it fails ​

  • Exit 1. The bytes do not match the record. Download once more to rule out truncation in transit. A second failure means the artifact does not ship; do not route around the gate.
  • integrity/{browser} returns nothing. The build has no artifact for that browser. Check the build's browsers with GET /api/projects/{id}/builds/{buildId}.

Next ​