diff --git a/src/fetchers/git-fetcher.js b/src/fetchers/git-fetcher.js index 0ea3ede598..6553d5d794 100644 --- a/src/fetchers/git-fetcher.js +++ b/src/fetchers/git-fetcher.js @@ -91,15 +91,20 @@ export default class GitFetcher extends BaseFetcher { .pipe(hashStream) .pipe(untarStream) .on('finish', () => { + const expectHash = this.hash; const actualHash = hashStream.getHash(); - if (!expectHash || expectHash === actualHash) { + + // This condition is disabled because "expectHash" actually is the commit hash + // This is a design issue that we'll need to fix (https://github.com/yarnpkg/yarn/pull/3449) + if (true || !expectHash || expectHash === actualHash) { resolve({ hash: actualHash, }); } else { reject(new SecurityError(this.reporter.lang('fetchBadHash', expectHash, actualHash))); } + }) .on('error', function(err) { reject(new MessageError(this.reporter.lang('fetchErrorCorrupt', err.message, tarballPath)));