refactor: Simplify SRI support to only add X-Integrity header with SHA-512

Co-authored-by: fengmk2 <156269+fengmk2@users.noreply.github.com>

app/core/service/PackageVersionFileService.ts

@@ -356,7 +356,8 @@ export class PackageVersionFileService extends AbstractService {
     const dist = pkg.createPackageVersionFile(distPath, pkgVersion.version, {
       size: stat.size,
       shasum: distIntegrity.shasum,
-      integrity: distIntegrity.integrity,
+      // Store the combined SRI string for enhanced SRI support while maintaining backwards compatibility
+      integrity: distIntegrity.sri.combined,
     });
     await this.distRepository.saveDist(dist, localFile);
     file = PackageVersionFile.create({

app/port/controller/PackageVersionFileController.ts

@@ -218,6 +218,12 @@ export class PackageVersionFileController extends AbstractController {
       return formatFileItem(file);
     }
     ctx.set('cache-control', FILE_CACHE_CONTROL);
+    
+    // Add SRI header for subresource integrity verification
+    if (file.dist.integrity) {
+      ctx.set('X-Integrity', file.dist.integrity);
+    }
+    
     // https://github.com/cnpm/cnpmcore/issues/693#issuecomment-2955268229
     ctx.type = ensureContentType(file.contentType);
     return await this.distRepository.getDistStream(file.dist);

test/port/controller/PackageVersionFileController/raw.test.ts

@@ -786,5 +786,30 @@ describe('test/port/controller/PackageVersionFileController/raw.test.ts', () =>
         `[NOT_FOUND] ${pkg.name}@1.0.40000404 not found`
       );
     });
+
+    it('should include X-Integrity header when serving raw files', async () => {
+      mock(app.config.cnpmcore, 'allowPublishNonScopePackage', true);
+      const pkg = await TestUtil.getFullPackage({
+        name: 'integrity-test-package',
+        version: '1.0.0',
+      });
+      await app
+        .httpRequest()
+        .put(`/${pkg.name}`)
+        .set('authorization', publisher.authorization)
+        .set('user-agent', publisher.ua)
+        .send(pkg)
+        .expect(201);
+
+      // Test raw file access includes X-Integrity header
+      const res = await app
+        .httpRequest()
+        .get(`/${pkg.name}/1.0.0/files/package.json`)
+        .expect(200);
+
+      // Should include X-Integrity header with SHA-512
+      assert.ok(res.headers['x-integrity'], 'Missing X-Integrity header');
+      assert.ok(res.headers['x-integrity'].startsWith('sha512-'), 'X-Integrity header should be SHA-512');
+    });
   });
 });