FG
🛠️ Developer ToolsMicrosoft

[BUG] package-lock.json integrity value for git dependencies depends on the architecture (Apple Silicon M1 differs)

Freshabout 4 years ago
Mar 14, 20260 views
Confidence Score77%
77%

Problem

Current Behavior: The `package-lock.json` integrity value seems to depend on the OS/architecture. Take the following git dependency which specifies a commit hash: [code block] The integrity value produced is different on these OSes/architectures: - Ubuntu 20.04, and macOS 11.2.3 (Intel): `sha512-DnBTbDDxd9/9mwPehyraeuRTbNEqbWLcAdE3GC1trdBWWwKnkWsaU/X6mVLIKKB/IYWmG+cnL3ihg/Ql/rW5kg==` - macOS 11.2.3 (Apple Silicon): `sha512-T3ZWOM1TT+Ch/splApkEe1HwktWs+n/iHvDvtIGEI+4xuMGHite6mMujuNd8sen49ofLP/PxzprQMSPJK8APww==` Expected Behavior: The integrity value should not be different on Apple Silicon (M1 chip) machines. Steps To Reproduce: Run `npm pack "git+ssh://git@github.com/jhiesey/idb-kv-store.git#109ccad165fd6470e12fd66025da9e4743a46043" ` and inspect the integrity value from an M1 Mac. Node.js was installed from Homebrew using `brew install node` and the `amd64` version was installed. Also... @jhiesey and I dug into this a bit and found that the tarballs fetched from the GitHub CDN are exactly the same on M1 and other architectures, byte-for-byte. Same for the ungzipped tarballs – they are the same byte-for-byte. What differs, though, is the gzipped tarballs (`.tar.gz`) files. Those appear to have substantial differences when viewed in a hex editor. Environment: - OS: Various, see above - Node: v15.11.0 - npm: 7.6.2

Unverified for your environment

Select your OS to check compatibility.

1 Fix

Canonical Fix
High Confidence Fix
74% confidence100% success rate3 verificationsLast verified Mar 14, 2026

Solution: [BUG] package-lock.json integrity value for git dependencies depends on the architecture (Apple Silicon M1 differs)

Low Risk

@nlf or @isaacs please reopen this issue; it has not been fixed: [code block]

74

Trust Score

3 verifications

100% success
  1. 1

    @nlf or @isaacs please reopen this issue; it has not been fixed:

    @nlf or @isaacs please reopen this issue; it has not been fixed:

Validation

Resolved in npm/cli GitHub issue #2846. Community reactions: 3 upvotes.

Verification Summary

Worked: 3
Partial: 1
Last verified Mar 14, 2026

Sign in to verify this fix

Environment

Submitted by

AC

Alex Chen

2450 rep

Tags

npmpackage-managernodejsrelease-7.xbugpriority-1