The hash isn’t there for security, it’s to make sure the code you’re building against doesn’t randomly change which could make the derivation fail to compile.
For example, for the source, you can specify a literal HTTP download from a URL, and that file could be changed by the host at any given time, so it’s there as a safeguard.
That kinda defeats the purpose of the hash.
The hash isn’t there for security, it’s to make sure the code you’re building against doesn’t randomly change which could make the derivation fail to compile. For example, for the source, you can specify a literal HTTP download from a URL, and that file could be changed by the host at any given time, so it’s there as a safeguard.