I create a .tgz/tarball with
I then run:
and I get:
I want to compare that shasum against another tarball on a remote server. I can query for a shasum for a tarball on the NPM registry, with:
npm view @oresoftware/npp@latest dist.shasum
this shasum is different than the other one above, but that's expected, since I changed the contents of the .tgz tarball file.
my question is 3 fold:
When I generated a sha1sum of the .tgz file resulting from
npm pack, is that the right way to do it? To generate the sha1sum after the tar file is created?
I assume that the the sha1sum would be identical if the tarballs had identical contents? Would they differ if the files were created/modified at different times even if they have otherwise the same contents?
Is there a better way to check if two tarballs have the same contents? That's all I am trying to do.