{"action":"created","issue":{"url":"https://api.github.com/repos/fsprojects/Paket/issues/1287","labels_url":"https://api.github.com/repos/fsprojects/Paket/issues/1287/labels{/name}","comments_url":"https://api.github.com/repos/fsprojects/Paket/issues/1287/comments","events_url":"https://api.github.com/repos/fsprojects/Paket/issues/1287/events","html_url":"https://github.com/fsprojects/Paket/issues/1287","id":120267768,"number":1287,"title":"Include hashes in lock file, for NuGet packages too?","user":{"login":"epsitec","id":3872435,"avatar_url":"https://avatars.githubusercontent.com/u/3872435?v=3","gravatar_id":"","url":"https://api.github.com/users/epsitec","html_url":"https://github.com/epsitec","followers_url":"https://api.github.com/users/epsitec/followers","following_url":"https://api.github.com/users/epsitec/following{/other_user}","gists_url":"https://api.github.com/users/epsitec/gists{/gist_id}","starred_url":"https://api.github.com/users/epsitec/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/epsitec/subscriptions","organizations_url":"https://api.github.com/users/epsitec/orgs","repos_url":"https://api.github.com/users/epsitec/repos","events_url":"https://api.github.com/users/epsitec/events{/privacy}","received_events_url":"https://api.github.com/users/epsitec/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-12-03T20:54:10Z","updated_at":"2015-12-03T21:00:30Z","closed_at":null,"body":"I am wondering if I am the only person who'd like to make sure that the packages that get restored after a clean checkout from source control are indeed the ones that were used when the lock file was commited.\r\n\r\nI feel incomfortable at the idea that somehow, somebody could hack the NuGet repository and that I would end up with other NuGet packages as what I used when I tested my code (e.g. when switching from testing to production, and rebuilding the code before it gets into the customer's hands).\r\n\r\nI have the same issue with NPM... but maybe I am just paranoid?"},"comment":{"url":"https://api.github.com/repos/fsprojects/Paket/issues/comments/161783123","html_url":"https://github.com/fsprojects/Paket/issues/1287#issuecomment-161783123","issue_url":"https://api.github.com/repos/fsprojects/Paket/issues/1287","id":161783123,"user":{"login":"epsitec","id":3872435,"avatar_url":"https://avatars.githubusercontent.com/u/3872435?v=3","gravatar_id":"","url":"https://api.github.com/users/epsitec","html_url":"https://github.com/epsitec","followers_url":"https://api.github.com/users/epsitec/followers","following_url":"https://api.github.com/users/epsitec/following{/other_user}","gists_url":"https://api.github.com/users/epsitec/gists{/gist_id}","starred_url":"https://api.github.com/users/epsitec/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/epsitec/subscriptions","organizations_url":"https://api.github.com/users/epsitec/orgs","repos_url":"https://api.github.com/users/epsitec/repos","events_url":"https://api.github.com/users/epsitec/events{/privacy}","received_events_url":"https://api.github.com/users/epsitec/received_events","type":"User","site_admin":false},"created_at":"2015-12-03T21:00:30Z","updated_at":"2015-12-03T21:00:30Z","body":"To avoid poisoning a build system, and having paket detect that there is a mismatch between the binaries which were used when the lock file was commited, and when the product finally got built."}}