Integrity check fails on Cloudflare Pages

[MrAlex94]

Possible install-time or require-time problem

• I have read and understood all of the documentation relating to installation.
• I have searched for known bugs relating to this problem in my choice of package manager.

Are you using the latest version of sharp?

• I am using the latest version of sharp as reported by npm view sharp dist-tags.latest.

Are you using a supported runtime?

• I am using Node.js with a version that satisfies ^18.17.0 || ^20.3.0 || >=21.0.0

• I am using Deno

• I am using Bun

• I am using npm >= 9.6.5 with --include=optional

• I am using yarn >= 3.2.0

• I am using pnpm >= 7.1.0 with --no-optional=false

• I am using Deno

• I am using Bun

What is the complete error message, including the full stack trace?

6:19:07.247 | Detected the following tools from environment: bun@1.0.21, nodejs@18.17.1
-- | --
16:19:07.247 | Installing bun 1.0.21
16:19:07.393 | Downloading Bun v1.0.21...
16:19:08.532 | Archive:  /tmp/asdf-bun.8NSm/bun.zip
16:19:09.343 | inflating: /opt/buildhome/.asdf/downloads/bun/1.0.21/bun
16:19:09.414 | Installing Bun v1.0.21...
16:19:09.548 | Bun v1.0.21 is installed successfully!
16:19:09.933 | Installing project dependencies: bun install --frozen-lockfile
16:19:10.202 | bun install v1.0.21 (837cbd60)
16:19:23.066 | sharp: Downloading https://github.com/lovell/sharp-libvips/releases/download/v8.14.5/libvips-8.14.5-linux-x64.tar.br
16:19:23.067 | sharp: Integrity expected: sha512-SlFWrITSW5XVUkaFPQOySAaSGXnhkGJCj8X2wGYYta9hk5piZldQyMp4zwy0z6UeRu1qKTKtZvmq28W3Gnh9xA==
16:19:23.067 | sharp: Integrity received: sha512-yepq00Ia8rz2Q8X8z3Pwp8IQPaoTuwlb3wwtv7Z/ZatpFJPwANkDLb59sxKZecuD6zQLhCe5OVbYow409Mqg9Q==
16:19:23.068 | sharp: Please see https://sharp.pixelplumbing.com/install for required dependencies
16:19:23.068 |  
16:19:23.068 | sharp: Installation error: Integrity check failed for linux-x64
16:19:23.068 |  
16:19:23.068 | error: install script from "sharp" exited with 1
16:19:23.113 | Error: Exit with error code: 1
16:19:23.118 | at ChildProcess.<anonymous> (/snapshot/dist/run-build.js)
16:19:23.118 | at Object.onceWrapper (node:events:652:26)
16:19:23.119 | at ChildProcess.emit (node:events:537:28)
16:19:23.119 | at ChildProcess._handle.onexit (node:internal/child_process:291:12)
16:19:23.139 | Failed: build command exited with code: 1
16:19:24.238 | Failed: error occurred while running build command

Sidenote: Every time the deployment is run again, a different hash is generated:

sharp: Integrity received: sha512-ttG0DkZ1HxNc6L96tGVHn645rz/WcdiB1ftLD7HQGKVxRX6c9dx8ezVTedWbJ92T/YJHyDSOXMsxIGi++jcWDg==
sharp: Integrity received: sha512-au6uDpgLCTX1RhvVmcTJM/5zXUxb6nrslEGrR52MuWGAHui5XYh6kJId6dzQtl4cMXQKqXF1hOBmFSwEtxnBYA==
sharp: Integrity received: sha512-VBh6H7CntISmjp1ca6zt4JH3jfIJXhSPzAZg2zIiDPzCrgm08LIcLM7qjPbKIzpBysPrUu5VDhLQhYBqL/s71w==

What is the complete output of running npm install --verbose --foreground-scripts sharp in an empty directory?

Unable to do so on Cloudflare Pages.

What is the output of running npx envinfo --binaries --system --npmPackages=sharp --npmGlobalPackages=sharp?

Unable to do so on Cloudflare Pages.

[MrAlex94]

Reverting to sharp@0.32.6 seems to not have this issue; any ways I can help test what the issue might be? Should I raise with Cloudflare?

[lovell]

These logs looks like they are from v0.32.x. Support for Bun was added in v0.33.0 - please upgrade.

[MrAlex94]

These logs looks like they are from v0.32.x. Support for Bun was added in v0.33.0 - please upgrade.

So an issue with Cloudflare then? The package was sharp@0.33.1, which is why I reported the issue. It works when setting to sharp@0.32.6 - if I upgrade again, same issue.

Edit: Seems to occur regardless of build cache being enabled or disabled.

[lovell]

The integrity check logic was removed in v0.33.0 as part of #3750 so the "Integrity check failed" message will never be generated by v0.33.1. Please check any lockfiles or cached node_modules for previous versions.

[MrAlex94]

OK, possible PEBKAC? The fix was to delete my existing bun.lockb and recreate it with bun install. Cloudflare Pages does bun install --frozen-lockfile by default, and I noticed when trying to test with npm, it would run that bun command first..and it worked! Pages uses Bun 1.0.1 by default, which reminded me of the release notes about changes to --frozen-lockfile in Bun 1.0.19.

At the same time I upgraded sharp from 0.32.6 to 0.33.1 I also went from Bun 1.0.18 → 1.0.21 in Pages (can set version with BUN_VERSION), but everything was working on my local computer, so didn't put the pieces together immediately.

I suppose a few things:

• Pages should probably not run any install steps without the user defining them.
• Bun 1.0.21 would not fail when running bun install --frozen-lockfile on macOS ARM64when there was no change to the lockfile; it seems to only fail on Linux x64 (the only other platform I can test, and the platform for Pages).
• Bun versions prior to 1.0.19 would update the bun.lockb file when running bun install, after upgrading packages.

Will see if I have enough info to file an issue with Bun.

Thanks for the help!