Fixes
- Legacy npm/yarn-v1 SHA-1 integrity pins are now verified against fetched bytes instead of reporting an unverifiable pin.
- Go h1: digests no longer mark fetches as unverifiable
- An unsupported digest (e.g. PyPI's blake2b_256/md5) no longer erases verification from a supported digest that matched.
- HTTP refusal status codes (e.g. 404) are recorded on the record's status field rather than only in error text.
- URL extraction trims trailing punctuation (line-continuation backslashes, sentence punctuation, empty fragments) so fewer bogus URLs are fetched.
Optimizations
- Pin verification evaluates manifest pin and PURL checksum qualifier independently with simpler precedence; URL/pin code path simplified.
Full Changelog: v1.2.0...v1.2.1