bower/bower — pull request #1592 by sheerun (2014-11-09 11:48:17+00:00)
Title: [WIP] Shrinkwrap feature

This is WIP PR, do not merge. You can send any work against this branch (even not fully working). It will be squashed at the end.

---

As mentioned in #505:

1. Lock file is named `bower.lock`
2. Lock file contains concatenated `.bower.json` files generated by bower (some subset of their keys)
3. On production bower installs non-development packages using endpoints from `bower.lock`
4. After installation it compares every `.bower.json` with entry in `bower.lock`. If something doesn't match, then source tampering is assumed, and the installation is immediately aborted.
5. For now the `_resolution` entry in `.bower.json` should be enough to prevent source tampering (as @schmurfy pointed out it's impossible to change source without changing sha of commit).
6. If in future we decide to implement full hashing, we'll just add it to `.bower.json` (there is no chicken-egg problem because `.bower.json` is generated by bower, not stored in source control).

For anyone who doesn't know how `.bower.json` looks like, [here is a sample](https://gist.github.com/sheerun/10695384). The keys that begin with underscore are added by bower. All other keys come from `bower.json` of component.