Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

vp 0.3.2: pnpm 12.4.2 integrity check compares sha384-computed (?) hash against sha512 packageManager pin

Open
#164 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
48/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Active
Tech stack
github-actions, typescript
Domain
ci-cd, devops

Research direction

No source files or tests are named. Start by reproducing vp install with setup-vp@v1.20.0, vp 0.3.2, and pnpm@12.4.2, then trace the package-manager integrity check; done means the pinned package installs successfully with the expected digest or a documented workaround is available.

Written by the indexing model from the issue text.

Description

Environment: setup-vp@v1.20.0, vp 0.3.2, ubuntu-latest runner, packageManager pin pnpm@12.4.2+sha512.CK3GYTGAJ1x8ntraOdzwjJxhrU5+rzMKTzRh8QKw+QdCNFTRF/mOctR/7wYWBwZE17/8lzpqV/UJCm18NosHyQ==.

Every job running vp install fails with:
error: Hash mismatch for pnpm@12.4.2: expected sha512.CK3GYTGAJ1x8ntraOdzwjJxhrU5+rzMKTzRh8QKw+QdCNFTRF/mOctR/7wYWBwZE17/8lzpqV/UJCm18NosHyQ==, got sha512.08adc6613180275c7c9edada39dcf08c9c61ad4e7eaf330a4f3461f102b0f907423454d117f98e72d47fef0616070644d7bffc973a6a57f5090a6d7c368b07c9

Observations:

  • The expected hash matches the npm registry dist.integrity for pnpm 12.4.2 exactly (verified), and a locally downloaded tarball hashes to it.
  • The 'got' value base64-decodes to 96 bytes (SHA-384 digest length), not 64 bytes (SHA-512). So the comparison looks like an algorithm mix-up (computed sha384 digest labeled sha512?) rather than a registry/tarball change.
  • Started when the repo moved to pnpm 12.4.2 + vite-plus 0.3.2 + setup-vp v1.20.0 (previous combo pnpm 11.x + vp 0.3.0 + setup-vp v1.18.0 installed fine).
  • Project: https://github.com/XrayIran/the-ai-studio/actions/runs/35150599162

Is this a known issue, and is there a recommended workaround (e.g. setup-vp package-manager input, VP_* override, or unpinned packageManager) until fixed?

Dominant language
TypeScript
Stars
110
Forks
22
Avg merge
1d 5h
Merged PRs (30d)
31

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from voidzero-dev/setup-vp

All issues in voidzero-dev/setup-vp

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.