If the shasum for a module is wrong, redownload it, unless you are in offline mode.
If the shasum for a module is wrong, redownload it, unless you are in offline mode.

This is very important moving forward, because increases the possibilities for npmd
to be both distributed and secure. The problem was that when npm downloads a package,
it unpacks it, and then repacks it. This will hash differently, because the files
will have new timestamps. This means it's only possible to check the integrety of a
tarball when you first download it, and not after.

This means that you cache can not really be trusted, although it's fine if you are
confidant that it was downloaded from npm, but if you provided that tarball to someone
else, there is no way they could verify it was authentic. npmd already keeps the tarballs
clean, but now it cleans up after npm! This means it's now possible to have p2p package
distribution! (although, there is a lot more work, this is the first step)

dominictarr/npmd-unpack