mirror of
https://github.com/l0ng-ai/openidea.git
synced 2026-11-06 16:08:05 +00:00
package_hash fed each package-relative path to the digest with to_string_lossy, so a walked path hashed as `web\index.html` on Windows and `web/index.html` elsewhere. The same package had two digests: a market index built on Linux failed verification on Windows, and a package signed on one OS did not verify on another. Join path components with `/` before hashing. Digests on macOS and Linux are unchanged byte for byte; installed plugins keep their recorded .package-hash, and a recomputed digest is accepted as a silent update by the grant ledger, so existing Windows installs are not re-prompted. Closes #1258