Merge pull request #1207 from ferd/pkg-local-hash-lock

lock file contains expected hash for pkg dependencies

10 files changed, 238 insertions, 44 deletions

diff --git a/test/mock_pkg_resource.erl b/test/mock_pkg_resource.erl
index a94fe2f..f837713 100644
--- a/test/mock_pkg_resource.erl
+++ b/test/mock_pkg_resource.erl
@@ -22,8 +22,9 @@ mock() -> mock([]).
             | {not_in_index, [{App, Vsn}]}
             | {pkgdeps, [{{App,Vsn}, [Dep]}]},
     App :: string(),
-    Dep :: {App, string(), {pkg, App, Vsn}},
-    Vsn :: string().
+    Dep :: {App, string(), {pkg, App, Vsn, Hash}},
+    Vsn :: string(),
+    Hash :: string() | undefined.
 mock(Opts) ->
     meck:new(?MOD, [no_link]),
     mock_lock(Opts),
@@ -51,7 +52,7 @@ mock_update(Opts) ->
     ToUpdate = proplists:get_value(upgrade, Opts, []),
     meck:expect(
         ?MOD, needs_update,
-        fun(_Dir, {pkg, App, _Vsn}) ->
+        fun(_Dir, {pkg, App, _Vsn, _Hash}) ->
             lists:member(binary_to_list(App), ToUpdate)
         end).
 
@@ -66,7 +67,7 @@ mock_vsn(_Opts) ->
 %% @doc For each app to download, create a dummy app on disk instead.
 %% The configuration for this one (passed in from `mock/1') includes:
 %%
-%% - Specify a version with `{pkg, _, Vsn}'
+%% - Specify a version with `{pkg, _, Vsn, _}'
 %% - Dependencies for each application must be passed of the form:
 %%   `{pkgdeps, [{"app1", [{app2, ".*", {pkg, ...}}]}]}' -- basically
 %%   the `pkgdeps' option takes a key/value list of terms to output directly
@@ -76,7 +77,7 @@ mock_download(Opts) ->
     Config = proplists:get_value(config, Opts, []),
     meck:expect(
         ?MOD, download,
-        fun (Dir, {pkg, AppBin, Vsn}, _) ->
+        fun (Dir, {pkg, AppBin, Vsn, _}, _) ->
             App = binary_to_list(AppBin),
             filelib:ensure_dir(Dir),
             AppDeps = proplists:get_value({App,Vsn}, Deps, []),
diff --git a/test/rebar_deps_SUITE.erl b/test/rebar_deps_SUITE.erl
index aa2e7b2..24bf2a0 100644
--- a/test/rebar_deps_SUITE.erl
+++ b/test/rebar_deps_SUITE.erl
@@ -476,5 +476,5 @@ in_warnings(git, Warns, NameRaw, VsnRaw) ->
 in_warnings(pkg, Warns, NameRaw, VsnRaw) ->
     Name = iolist_to_binary(NameRaw),
     Vsn = iolist_to_binary(VsnRaw),
-    1 =< length([1 || {_, [AppName, {pkg, _, AppVsn}]} <- Warns,
+    1 =< length([1 || {_, [AppName, {pkg, _, AppVsn, _}]} <- Warns,
                       AppName =:= Name, AppVsn =:= Vsn]).
diff --git a/test/rebar_install_deps_SUITE.erl b/test/rebar_install_deps_SUITE.erl
index b8b70b3..9ff28c7 100644
--- a/test/rebar_install_deps_SUITE.erl
+++ b/test/rebar_install_deps_SUITE.erl
@@ -475,5 +475,5 @@ in_warnings(git, Warns, NameRaw, VsnRaw) ->
 in_warnings(pkg, Warns, NameRaw, VsnRaw) ->
     Name = iolist_to_binary(NameRaw),
     Vsn = iolist_to_binary(VsnRaw),
-    1 =< length([1 || {_, [AppName, {pkg, _, AppVsn}]} <- Warns,
+    1 =< length([1 || {_, [AppName, {pkg, _, AppVsn, _}]} <- Warns,
                       AppName =:= Name, AppVsn =:= Vsn]).
diff --git a/test/rebar_lock_SUITE.erl b/test/rebar_lock_SUITE.erl
index 00875f7..f1ab3b5 100644
--- a/test/rebar_lock_SUITE.erl
+++ b/test/rebar_lock_SUITE.erl
@@ -7,7 +7,8 @@
 -include_lib("common_test/include/ct.hrl").
 -include_lib("eunit/include/eunit.hrl").
 
-all() -> [current_version, future_versions_no_attrs, future_versions_attrs].
+all() -> [current_version,
+          beta_version, future_versions_no_attrs, future_versions_attrs].
 
 current_version(Config) ->
     %% Current version just dumps the locks as is on disk.
@@ -15,9 +16,60 @@ current_version(Config) ->
     Locks = [{<<"app1">>, {git,"some_url", {ref,"some_ref"}}, 2},
              {<<"app2">>, {git,"some_url", {ref,"some_ref"}}, 0},
              {<<"app3">>, {hg,"some_url", {ref,"some_ref"}}, 1},
+             {<<"pkg1">>,{pkg,<<"name">>,<<"0.1.6">>},3},
+             {<<"pkg2">>,{pkg,<<"name1">>,<<"1.1.6">>},2},
+             {<<"pkg3">>,{pkg,<<"name2">>,<<"3.0.6">>},1}
+            ],
+    ExpandedNull = [
+        {<<"app1">>, {git,"some_url", {ref,"some_ref"}}, 2},
+        {<<"app2">>, {git,"some_url", {ref,"some_ref"}}, 0},
+        {<<"app3">>, {hg,"some_url", {ref,"some_ref"}}, 1},
+        {<<"pkg1">>,{pkg,<<"name">>,<<"0.1.6">>,undefined},3},
+        {<<"pkg2">>,{pkg,<<"name1">>,<<"1.1.6">>,undefined},2},
+        {<<"pkg3">>,{pkg,<<"name2">>,<<"3.0.6">>,undefined},1}
+    ],
+    %% Simulate a beta lockfile
+    file:write_file(LockFile, io_lib:format("~p.~n", [Locks])),
+    %% No properties fetched from a beta lockfile, expand locks
+    %% to undefined
+    ?assertEqual(ExpandedNull,
+                 rebar_config:consult_lock_file(LockFile)),
+    %% Adding hash data
+    Hashes = [{<<"pkg1">>, <<"tarballhash">>},
+              {<<"pkg3">>, <<"otherhash">>}],
+    ExpandedLocks = [
+        {<<"app1">>, {git,"some_url", {ref,"some_ref"}}, 2},
+        {<<"app2">>, {git,"some_url", {ref,"some_ref"}}, 0},
+        {<<"app3">>, {hg,"some_url", {ref,"some_ref"}}, 1},
+        {<<"pkg1">>,{pkg,<<"name">>,<<"0.1.6">>,<<"tarballhash">>},3},
+        {<<"pkg2">>,{pkg,<<"name1">>,<<"1.1.6">>,undefined},2},
+        {<<"pkg3">>,{pkg,<<"name2">>,<<"3.0.6">>,<<"otherhash">>},1}
+    ],
+    file:write_file(LockFile,
+                    io_lib:format("~p.~n~p.~n",
+                                  [{"1.1.0", Locks},
+                                   [{pkg_hash, Hashes}]])),
+    ?assertEqual(ExpandedLocks, rebar_config:consult_lock_file(LockFile)),
+    %% Then check that we can reverse that
+    ok = rebar_config:write_lock_file(LockFile, ExpandedLocks),
+    ?assertEqual({ok, [{"1.1.0", Locks}, [{pkg_hash, Hashes}]]},
+                 file:consult(LockFile)).
+
+beta_version(Config) ->
+    %% Current version just dumps the locks as is on disk.
+    LockFile = filename:join(?config(priv_dir, Config), "current_version"),
+    Locks = [{<<"app1">>, {git,"some_url", {ref,"some_ref"}}, 2},
+             {<<"app2">>, {git,"some_url", {ref,"some_ref"}}, 0},
+             {<<"app3">>, {hg,"some_url", {ref,"some_ref"}}, 1},
              {<<"pkg1">>,{pkg,<<"name">>,<<"0.1.6">>},3}],
+    ExpandedLocks = [
+        {<<"app1">>, {git,"some_url", {ref,"some_ref"}}, 2},
+        {<<"app2">>, {git,"some_url", {ref,"some_ref"}}, 0},
+        {<<"app3">>, {hg,"some_url", {ref,"some_ref"}}, 1},
+        {<<"pkg1">>,{pkg,<<"name">>,<<"0.1.6">>,undefined},3}
+    ],
     file:write_file(LockFile, io_lib:format("~p.~n", [Locks])),
-    ?assertEqual(Locks, rebar_config:consult_lock_file(LockFile)).
+    ?assertEqual(ExpandedLocks, rebar_config:consult_lock_file(LockFile)).
 
 future_versions_no_attrs(Config) ->
     %% Future versions will keep the same core attribute in there, but
@@ -27,10 +79,14 @@ future_versions_no_attrs(Config) ->
     Locks = [{<<"app1">>, {git,"some_url", {ref,"some_ref"}}, 2},
              {<<"app2">>, {git,"some_url", {ref,"some_ref"}}, 0},
              {<<"app3">>, {hg,"some_url", {ref,"some_ref"}}, 1},
-             {<<"pkg1">>,{pkg,<<"name">>,<<"0.1.6">>},3}],
+             {<<"pkg1">>, {pkg,<<"name">>,<<"0.1.6">>},3}],
+    ExpandedLocks = [{<<"app1">>, {git,"some_url", {ref,"some_ref"}}, 2},
+                     {<<"app2">>, {git,"some_url", {ref,"some_ref"}}, 0},
+                     {<<"app3">>, {hg,"some_url", {ref,"some_ref"}}, 1},
+                     {<<"pkg1">>, {pkg,<<"name">>,<<"0.1.6">>,undefined},3}],
     LockData = {"3.5.2", Locks},
     file:write_file(LockFile, io_lib:format("~p.~n", [LockData])),
-    ?assertEqual(Locks, rebar_config:consult_lock_file(LockFile)).
+    ?assertEqual(ExpandedLocks, rebar_config:consult_lock_file(LockFile)).
 
 future_versions_attrs(Config) ->
     %% Future versions will keep the same core attribute in there, but
@@ -41,6 +97,16 @@ future_versions_attrs(Config) ->
              {<<"app2">>, {git,"some_url", {ref,"some_ref"}}, 0},
              {<<"app3">>, {hg,"some_url", {ref,"some_ref"}}, 1},
              {<<"pkg1">>,{pkg,<<"name">>,<<"0.1.6">>},3}],
+    ExpandedLocks = [{<<"app1">>, {git,"some_url", {ref,"some_ref"}}, 2},
+                     {<<"app2">>, {git,"some_url", {ref,"some_ref"}}, 0},
+                     {<<"app3">>, {hg,"some_url", {ref,"some_ref"}}, 1},
+                     {<<"pkg1">>,{pkg,<<"name">>,<<"0.1.6">>, <<"tarballhash">>},3}],
+    Hashes = [{<<"pkg1">>, <<"tarballhash">>}],
     LockData = {"3.5.2", Locks},
-    file:write_file(LockFile, io_lib:format("~p.~na.~n{b,c}.~n[d,e,f].~n", [LockData])),
-    ?assertEqual(Locks, rebar_config:consult_lock_file(LockFile)).
+    file:write_file(LockFile,
+                    io_lib:format("~p.~n~p.~ngarbage.~n",
+                                  [LockData,
+                                   [{a, x},
+                                    {pkg_hash, Hashes},
+                                    {b, y}]])),
+    ?assertEqual(ExpandedLocks, rebar_config:consult_lock_file(LockFile)).
diff --git a/test/rebar_pkg_SUITE.erl b/test/rebar_pkg_SUITE.erl
index 6a75f32..30cc0a8 100644
--- a/test/rebar_pkg_SUITE.erl
+++ b/test/rebar_pkg_SUITE.erl
@@ -11,6 +11,7 @@
 -define(good_checksum, <<"1C6CE379D191FBAB41B7905075E0BF87CBBE23C77CECE775C5A0B786B2244C35">>).
 
 all() -> [good_uncached, good_cached, badindexchk, badpkg,
+          badhash_nocache, badhash_cache,
           bad_to_good, good_disconnect, bad_disconnect, pkgs_provider,
           find_highest_matching].
 
@@ -58,6 +59,19 @@ init_per_testcase(badpkg=Name, Config0) ->
               {pkg, {<<"badpkg">>, <<"1.0.0">>}}
              | Config0],
     mock_config(Name, Config);
+init_per_testcase(badhash_nocache=Name, Config0) ->
+    Config = [{good_cache, false},
+              {pkg, {<<"goodpkg">>, <<"1.0.0">>}}
+             | Config0],
+    mock_config(Name, Config);
+init_per_testcase(badhash_cache=Name, Config0) ->
+    Pkg = {<<"goodpkg">>, <<"1.0.0">>},
+    Config1 = [{good_cache, true},
+               {pkg, Pkg}
+              | Config0],
+    Config = mock_config(Name, Config1),
+    copy_to_cache(Pkg, Config),
+    Config;
 init_per_testcase(bad_to_good=Name, Config0) ->
     Config1 = [{good_cache, false},
               {pkg, {<<"goodpkg">>, <<"1.0.0">>}}
@@ -103,7 +117,7 @@ good_uncached(Config) ->
     {Pkg,Vsn} = ?config(pkg, Config),
     State = ?config(state, Config),
     ?assertEqual({ok, true},
-                 rebar_pkg_resource:download(Tmp, {pkg, Pkg, Vsn}, State)),
+                 rebar_pkg_resource:download(Tmp, {pkg, Pkg, Vsn, ?good_checksum}, State)),
     Cache = ?config(cache_dir, Config),
     ?assert(filelib:is_regular(filename:join(Cache, <<Pkg/binary, "-", Vsn/binary, ".tar">>))).
 
@@ -116,7 +130,7 @@ good_cached(Config) ->
     ?assert(filelib:is_regular(CachedFile)),
     {ok, Content} = file:read_file(CachedFile),
     ?assertEqual({ok, true},
-                 rebar_pkg_resource:download(Tmp, {pkg, Pkg, Vsn}, State)),
+                 rebar_pkg_resource:download(Tmp, {pkg, Pkg, Vsn, ?good_checksum}, State)),
     {ok, Content} = file:read_file(CachedFile).
 
 badindexchk(Config) ->
@@ -124,7 +138,7 @@ badindexchk(Config) ->
     {Pkg,Vsn} = ?config(pkg, Config),
     State = ?config(state, Config),
     ?assertMatch({bad_registry_checksum, _Path},
-                 rebar_pkg_resource:download(Tmp, {pkg, Pkg, Vsn}, State)),
+                 rebar_pkg_resource:download(Tmp, {pkg, Pkg, Vsn, ?good_checksum}, State)),
     %% The cached file is there for forensic purposes
     Cache = ?config(cache_dir, Config),
     ?assert(filelib:is_regular(filename:join(Cache, <<Pkg/binary, "-", Vsn/binary, ".tar">>))).
@@ -134,11 +148,35 @@ badpkg(Config) ->
     {Pkg,Vsn} = ?config(pkg, Config),
     State = ?config(state, Config),
     ?assertMatch({bad_download, _Path},
-                 rebar_pkg_resource:download(Tmp, {pkg, Pkg, Vsn}, State)),
+                 rebar_pkg_resource:download(Tmp, {pkg, Pkg, Vsn, ?good_checksum}, State)),
     %% The cached file is there for forensic purposes
     Cache = ?config(cache_dir, Config),
     ?assert(filelib:is_regular(filename:join(Cache, <<Pkg/binary, "-", Vsn/binary, ".tar">>))).
 
+badhash_nocache(Config) ->
+    Tmp = ?config(tmp_dir, Config),
+    {Pkg,Vsn} = ?config(pkg, Config),
+    State = ?config(state, Config),
+    ?assertMatch({unexpected_hash, _Path, ?bad_checksum, ?good_checksum},
+                 rebar_pkg_resource:download(Tmp, {pkg, Pkg, Vsn, ?bad_checksum}, State)),
+    %% The cached file is there for forensic purposes
+    Cache = ?config(cache_dir, Config),
+    ?assert(filelib:is_regular(filename:join(Cache, <<Pkg/binary, "-", Vsn/binary, ".tar">>))).
+
+badhash_cache(Config) ->
+    Tmp = ?config(tmp_dir, Config),
+    {Pkg,Vsn} = ?config(pkg, Config),
+    Cache = ?config(cache_dir, Config),
+    State = ?config(state, Config),
+    CachedFile = filename:join(Cache, <<Pkg/binary, "-", Vsn/binary, ".tar">>),
+    ?assert(filelib:is_regular(CachedFile)),
+    {ok, Content} = file:read_file(CachedFile),
+    ?assertMatch({unexpected_hash, _Path, ?bad_checksum, ?good_checksum},
+                 rebar_pkg_resource:download(Tmp, {pkg, Pkg, Vsn, ?bad_checksum}, State)),
+    %% The cached file is there still, unchanged.
+    ?assert(filelib:is_regular(CachedFile)),
+    ?assertEqual({ok, Content}, file:read_file(CachedFile)).
+
 bad_to_good(Config) ->
     Tmp = ?config(tmp_dir, Config),
     {Pkg,Vsn} = ?config(pkg, Config),
@@ -148,7 +186,7 @@ bad_to_good(Config) ->
     ?assert(filelib:is_regular(CachedFile)),
     {ok, Contents} = file:read_file(CachedFile),
     ?assertEqual({ok, true},
-                 rebar_pkg_resource:download(Tmp, {pkg, Pkg, Vsn}, State)),
+                 rebar_pkg_resource:download(Tmp, {pkg, Pkg, Vsn, ?good_checksum}, State)),
     %% Cache has refreshed
     ?assert({ok, Contents} =/= file:read_file(CachedFile)).
 
@@ -161,7 +199,7 @@ good_disconnect(Config) ->
     ?assert(filelib:is_regular(CachedFile)),
     {ok, Content} = file:read_file(CachedFile),
     ?assertEqual({ok, true},
-                 rebar_pkg_resource:download(Tmp, {pkg, Pkg, Vsn}, State)),
+                 rebar_pkg_resource:download(Tmp, {pkg, Pkg, Vsn, ?good_checksum}, State)),
     {ok, Content} = file:read_file(CachedFile).
 
 bad_disconnect(Config) ->
@@ -169,7 +207,7 @@ bad_disconnect(Config) ->
     {Pkg,Vsn} = ?config(pkg, Config),
     State = ?config(state, Config),
     ?assertEqual({fetch_fail, Pkg, Vsn},
-                 rebar_pkg_resource:download(Tmp, {pkg, Pkg, Vsn}, State)).
+                 rebar_pkg_resource:download(Tmp, {pkg, Pkg, Vsn, ?good_checksum}, State)).
 
 pkgs_provider(Config) ->
     Config1 = rebar_test_utils:init_rebar_state(Config),
diff --git a/test/rebar_pkg_alias_SUITE.erl b/test/rebar_pkg_alias_SUITE.erl
index fef2310..8915357 100644
--- a/test/rebar_pkg_alias_SUITE.erl
+++ b/test/rebar_pkg_alias_SUITE.erl
@@ -55,7 +55,7 @@ diff_alias(Config) ->
         Config, RebarConfig, ["lock"],
         {ok, [{lock, "fakelib"},{dep, "fakelib"}]}
     ),
-    {ok, [LockData]} = file:consult(Lockfile),
+    {ok, [{_Vsn, LockData}|_]} = file:consult(Lockfile),
     ?assert(lists:any(fun({<<"fakelib">>,{pkg,<<"goodpkg">>,_},_}) -> true
                       ;  (_) -> false end, LockData)),
     %% An second run yields the same
@@ -63,13 +63,13 @@ diff_alias(Config) ->
         Config, RebarConfig, ["lock"],
         {ok, [{lock, "fakelib"},{dep, "fakelib"}]}
     ),
-    {ok, [LockData]} = file:consult(Lockfile),
+    {ok, [{_Vsn, LockData}|_]} = file:consult(Lockfile),
     %% So does an upgrade
     rebar_test_utils:run_and_check(
         Config, RebarConfig, ["upgrade"],
         {ok, [{lock, "fakelib"},{dep, "fakelib"}]}
     ),
-    {ok, [LockData]} = file:consult(Lockfile).
+    {ok, [{_Vsn, LockData}|_]} = file:consult(Lockfile).
 
 diff_alias_vsn(Config) -> diff_alias(Config).
 
diff --git a/test/rebar_test_utils.erl b/test/rebar_test_utils.erl
index 23b0178..8c177c9 100644
--- a/test/rebar_test_utils.erl
+++ b/test/rebar_test_utils.erl
@@ -7,6 +7,13 @@
          create_config/2, create_config/3, package_app/3]).
 -export([create_random_name/1, create_random_vsn/0, write_src_file/2]).
 
+%% Pick the right random module
+-ifdef(rand_only).
+-define(random, rand).
+-else.
+-define(random, random).
+-endif.
+
 %%%%%%%%%%%%%%
 %%% Public %%%
 %%%%%%%%%%%%%%
@@ -126,20 +133,24 @@ create_config(_AppDir, ConfFilename, Contents) ->
 %% @doc Util to create a random variation of a given name.
 create_random_name(Name) ->
     random_seed(),
-    Name ++ erlang:integer_to_list(random:uniform(1000000)).
+    Name ++ erlang:integer_to_list(?random:uniform(1000000)).
 
 %% @doc Util to create a random variation of a given version.
 create_random_vsn() ->
     random_seed(),
-    lists:flatten([erlang:integer_to_list(random:uniform(100)),
-                   ".", erlang:integer_to_list(random:uniform(100)),
-                   ".", erlang:integer_to_list(random:uniform(100))]).
+    lists:flatten([erlang:integer_to_list(?random:uniform(100)),
+                   ".", erlang:integer_to_list(?random:uniform(100)),
+                   ".", erlang:integer_to_list(?random:uniform(100))]).
 
+-ifdef(rand_only).
+random_seed() ->
+    %% the rand module self-seeds
+    ok.
+-else.
 random_seed() ->
     <<A:32, B:32, C:32>> = crypto:rand_bytes(12),
     random:seed({A,B,C}).
-
-
+-endif.
 
 expand_deps(_, []) -> [];
 expand_deps(git, [{Name, Deps} | Rest]) ->
@@ -149,21 +160,21 @@ expand_deps(git, [{Name, Vsn, Deps} | Rest]) ->
     Dep = {Name, Vsn, {git, "https://example.org/user/"++Name++".git", {tag, Vsn}}},
     [{Dep, expand_deps(git, Deps)} | expand_deps(git, Rest)];
 expand_deps(pkg, [{Name, Deps} | Rest]) ->
-    Dep = {pkg, Name, "0.0.0"},
+    Dep = {pkg, Name, "0.0.0", undefined},
     [{Dep, expand_deps(pkg, Deps)} | expand_deps(pkg, Rest)];
 expand_deps(pkg, [{Name, Vsn, Deps} | Rest]) ->
-    Dep = {pkg, Name, Vsn},
+    Dep = {pkg, Name, Vsn, undefined},
     [{Dep, expand_deps(pkg, Deps)} | expand_deps(pkg, Rest)];
 expand_deps(mixed, [{Name, Deps} | Rest]) ->
     Dep = if hd(Name) >= $a, hd(Name) =< $z ->
-            {pkg, string:to_upper(Name), "0.0.0"}
+            {pkg, string:to_upper(Name), "0.0.0", undefined}
            ; hd(Name) >= $A, hd(Name) =< $Z ->
             {Name, ".*", {git, "https://example.org/user/"++Name++".git", "master"}}
     end,
     [{Dep, expand_deps(mixed, Deps)} | expand_deps(mixed, Rest)];
 expand_deps(mixed, [{Name, Vsn, Deps} | Rest]) ->
     Dep = if hd(Name) >= $a, hd(Name) =< $z ->
-            {pkg, string:to_upper(Name), Vsn}
+            {pkg, string:to_upper(Name), Vsn, undefined}
            ; hd(Name) >= $A, hd(Name) =< $Z ->
             {Name, Vsn, {git, "https://example.org/user/"++Name++".git", {tag, Vsn}}}
     end,
@@ -177,7 +188,7 @@ expand_deps(mixed, [{Name, Vsn, Deps} | Rest]) ->
 flat_deps(Deps) -> flat_deps(Deps, [], []).
 
 flat_deps([], Src, Pkg) -> {Src, Pkg};
-flat_deps([{{pkg, Name, Vsn}, PkgDeps} | Rest], Src, Pkg) ->
+flat_deps([{{pkg, Name, Vsn, undefined}, PkgDeps} | Rest], Src, Pkg) ->
     Current = {{iolist_to_binary(Name), iolist_to_binary(Vsn)},
                top_level_deps(PkgDeps)},
     {[], FlatPkgDeps} = flat_deps(PkgDeps),
@@ -195,7 +206,7 @@ vsn_from_ref({git, _, {_, Vsn}}) -> Vsn;
 vsn_from_ref({git, _, Vsn}) -> Vsn.
 
 top_level_deps([]) -> [];
-top_level_deps([{{pkg, Name, Vsn}, _} | Deps]) ->
+top_level_deps([{{pkg, Name, Vsn, undefined}, _} | Deps]) ->
     [{list_to_atom(Name), Vsn} | top_level_deps(Deps)];
 top_level_deps([{{Name, Vsn, Ref}, _} | Deps]) ->
     [{list_to_atom(Name), Vsn, Ref} | top_level_deps(Deps)].
@@ -306,9 +317,10 @@ check_results(AppDir, Expected, ProfileRun) ->
                 case lists:keyfind(iolist_to_binary(Name), 1, Locks) of
                     false ->
                         error({lock_not_found, Name});
-                    {_LockName, {pkg, _, LockVsn}, _} ->
+                    {_LockName, {pkg, _, LockVsn, Hash}, _} ->
                         ?assertEqual(iolist_to_binary(Vsn),
-                                     iolist_to_binary(LockVsn));
+                                     iolist_to_binary(LockVsn)),
+                        ?assertNotEqual(undefined, Hash);
                     {_LockName, {_, _, {ref, LockVsn}}, _} ->
                         ?assertEqual(iolist_to_binary(Vsn),
                                      iolist_to_binary(LockVsn))
@@ -318,9 +330,10 @@ check_results(AppDir, Expected, ProfileRun) ->
                 case lists:keyfind(iolist_to_binary(Name), 1, Locks) of
                     false ->
                         error({lock_not_found, Name});
-                    {_LockName, {pkg, _, LockVsn}, _} ->
+                    {_LockName, {pkg, _, LockVsn, Hash}, _} ->
                         ?assertEqual(iolist_to_binary(Vsn),
-                                     iolist_to_binary(LockVsn));
+                                     iolist_to_binary(LockVsn)),
+                        ?assertNotEqual(undefined, Hash);
                     {_LockName, {_, _, {ref, LockVsn}}, _} ->
                         error({source_lock, {Name, LockVsn}})
                 end
@@ -329,7 +342,7 @@ check_results(AppDir, Expected, ProfileRun) ->
                 case lists:keyfind(iolist_to_binary(Name), 1, Locks) of
                     false ->
                         error({lock_not_found, Name});
-                    {_LockName, {pkg, _, LockVsn}, _} ->
+                    {_LockName, {pkg, _, LockVsn, _}, _} ->
                         error({pkg_lock, {Name, LockVsn}});
                     {_LockName, {_, _, {ref, LockVsn}}, _} ->
                         ?assertEqual(iolist_to_binary(Vsn),
diff --git a/test/rebar_unlock_SUITE.erl b/test/rebar_unlock_SUITE.erl
index 31dca72..8dbdb3a 100644
--- a/test/rebar_unlock_SUITE.erl
+++ b/test/rebar_unlock_SUITE.erl
@@ -3,8 +3,14 @@
 -include_lib("eunit/include/eunit.hrl").
 -compile(export_all).
 
-all() -> [unlock, unlock_all].
+all() -> [pkgunlock, unlock, unlock_all].
 
+init_per_testcase(pkgunlock, Config0) ->
+    Config = rebar_test_utils:init_rebar_state(Config0, "pkgunlock"),
+    Lockfile = filename:join(?config(apps, Config), "rebar.lock"),
+    ec_file:copy(filename:join(?config(data_dir, Config), "pkg.rebar.lock"),
+                 Lockfile),
+    [{lockfile, Lockfile} | Config];
 init_per_testcase(Case, Config0) ->
     Config = rebar_test_utils:init_rebar_state(Config0, atom_to_list(Case)),
     Lockfile = filename:join(?config(apps, Config), "rebar.lock"),
@@ -15,6 +21,23 @@ init_per_testcase(Case, Config0) ->
 end_per_testcase(_, Config) ->
     Config.
 
+pkgunlock(Config) ->
+    Locks = read_locks(Config),
+    Hashes = read_hashes(Config),
+    rebar_test_utils:run_and_check(Config, [], ["unlock", "fakeapp"], {ok, []}),
+    Locks = read_locks(Config),
+    Hashes = read_hashes(Config),
+    rebar_test_utils:run_and_check(Config, [], ["unlock", "bbmustache"], {ok, []}),
+    ?assertEqual(Locks -- ["bbmustache"], read_locks(Config)),
+    ?assertEqual(Hashes -- ["bbmustache"], read_hashes(Config)),
+    rebar_test_utils:run_and_check(Config, [], ["unlock", "cf,certifi"], {ok, []}),
+    ?assertEqual(Locks -- ["bbmustache","cf","certifi"], read_locks(Config)),
+    ?assertEqual(Hashes -- ["bbmustache","cf","certifi"], read_hashes(Config)),
+    rebar_test_utils:run_and_check(Config, [], ["unlock", string:join(Locks,",")], {ok, []}),
+    ?assertEqual({error, enoent}, read_locks(Config)),
+    ?assertEqual({error, enoent}, read_hashes(Config)),
+    ok.
+
 unlock(Config) ->
     Locks = read_locks(Config),
     rebar_test_utils:run_and_check(Config, [], ["unlock", "fakeapp"], {ok, []}),
@@ -35,6 +58,20 @@ unlock_all(Config) ->
 
 read_locks(Config) ->
     case file:consult(?config(lockfile, Config)) of
-        {ok, [Locks]} -> [binary_to_list(element(1,Lock)) || Lock <- Locks];
-        Other -> Other
+        {ok, _} ->
+            Locks = rebar_config:consult_lock_file(?config(lockfile, Config)),
+            [binary_to_list(element(1,Lock)) || Lock <- Locks];
+        Other ->
+            Other
+    end.
+
+read_hashes(Config) ->
+    case file:consult(?config(lockfile, Config)) of
+        {ok, [{_Vsn, _Locks},Props|_]} ->
+            Hashes = proplists:get_value(pkg_hash, Props, []),
+            [binary_to_list(element(1,Hash)) || Hash <- Hashes];
+        {ok, [{_Vsn, _Locks}]} ->
+            [];
+        Other ->
+            Other
     end.
diff --git a/test/rebar_unlock_SUITE_data/pkg.rebar.lock b/test/rebar_unlock_SUITE_data/pkg.rebar.lock
new file mode 100644
index 0000000..38e22e5
--- /dev/null
+++ b/test/rebar_unlock_SUITE_data/pkg.rebar.lock
@@ -0,0 +1,32 @@
+{"1.1.0",[{<<"bbmustache">>,{pkg,<<"bbmustache">>,<<"1.0.4">>},0},
+          {<<"certifi">>,{pkg,<<"certifi">>,<<"0.4.0">>},0},
+          {<<"cf">>,{pkg,<<"cf">>,<<"0.2.1">>},0},
+          {<<"cth_readable">>,{pkg,<<"cth_readable">>,<<"1.2.2">>},0},
+          {<<"erlware_commons">>,{pkg,<<"erlware_commons">>,<<"0.21.0">>},0},
+          {<<"eunit_formatters">>,{pkg,<<"eunit_formatters">>,<<"0.3.1">>},0},
+          {<<"getopt">>,{pkg,<<"getopt">>,<<"0.8.2">>},0},
+          {<<"providers">>,{pkg,<<"providers">>,<<"1.6.0">>},0},
+          {<<"relx">>,{pkg,<<"relx">>,<<"3.19.0">>},0},
+          {<<"ssl_verify_hostname">>,
+           {pkg,<<"ssl_verify_hostname">>,<<"1.0.5">>},
+           0}]}.
+[{pkg_hash,[{<<"bbmustache">>,
+             <<"7BA94F971C5AFD7B6617918A4BB74705E36CAB36EB84B19B6A1B7EE06427AA38">>},
+            {<<"certifi">>,
+             <<"A7966EFB868B179023618D29A407548F70C52466BF1849B9E8EBD0E34B7EA11F">>},
+            {<<"cf">>,
+             <<"69D0B1349FD4D7D4DC55B7F407D29D7A840BF9A1EF5AF529F1EBE0CE153FC2AB">>},
+            {<<"cth_readable">>,
+             <<"983913A8E8572310B7EAF5F2631148B7D70B3C090D2120DCFE777A93AA4165FB">>},
+            {<<"erlware_commons">>,
+             <<"A04433071AD7D112EDEFC75AC77719DD3E6753E697AC09428FC83D7564B80B15">>},
+            {<<"eunit_formatters">>,
+             <<"7A6FC351EB5B873E2356B8852EB751E20C13A72FBCA03393CF682B8483509573">>},
+            {<<"getopt">>,
+             <<"B17556DB683000BA50370B16C0619DF1337E7AF7ECBF7D64FBF8D1D6BCE3109B">>},
+            {<<"providers">>,
+             <<"DB0E2F9043AE60C0155205FCD238D68516331D0E5146155E33D1E79DC452964A">>},
+            {<<"relx">>,
+             <<"286DD5244B4786F56AAC75D5C8E2D1FB4CFD306810D4EC8548F3AE1B3AADB8F7">>},
+            {<<"ssl_verify_hostname">>,
+             <<"2E73E068CD6393526F9FA6D399353D7C9477D6886BA005F323B592D389FB47BE">>}]}].
diff --git a/test/rebar_upgrade_SUITE.erl b/test/rebar_upgrade_SUITE.erl
index e7651a1..66e1fdf 100644
--- a/test/rebar_upgrade_SUITE.erl
+++ b/test/rebar_upgrade_SUITE.erl
@@ -654,7 +654,14 @@ novsn_pkg(Config) ->
 rewrite_locks({ok, Expectations}, Config) ->
     AppDir = ?config(apps, Config),
     LockFile = filename:join([AppDir, "rebar.lock"]),
-    {ok, [Locks]} = file:consult(LockFile),
+    Locks = case ?config(deps_type, Config) of
+                git ->
+                    {ok, [LockData]} = file:consult(LockFile),
+                    LockData;
+                pkg ->
+                    {ok, [{_Vsn, LockData}|_]} = file:consult(LockFile),
+                    LockData
+            end,
     ExpLocks = [{list_to_binary(Name), Vsn}
                || {lock, Name, Vsn} <- Expectations],
     NewLocks = lists:foldl(