A hash proves the bytes, not the source
Summary
Collider explains how it verifies dependencies with content hashes and origin pinning, but notes that the fetch decisions happen before hashing. It covers input sanitization to prevent path traversal, safe extraction of archives, stripping bearer tokens on cross-origin redirects, and the move toward signing for provenance.