Private repository providers sha256 is null - is this OK?

[herndlm]

We're using a Nexus repository with the Composer plugin installed and I noticed that querying packages.json returns this

{
  "providers-url": "https://host/repository/repo-name/p/%package%.json",
  "providers": {
    "foo/bar": {
      "sha256": null
    }
  }
}

Renovate does not expect sha256 to be null here and I'm currently fixing that. But before I submit the PR I wanted to make sure this is actually fine or is there something broken in Nexus or its plugin?

Btw. I'm fine if this cannot be answered / is not supported because of private packagist which I would totally understand.

[Seldaek]

It's not an ideal repository implementation if it doesn't have hashes as it forbids caching, plus it is Composer v1 format and not the faster Composer v2 one, but technically null values there are supported by Composer.

[herndlm]

Thank you for that detailed answer!