#18231 Verify digest of remote cache hits while streaming them, not as a separate pass Issue created by huonw Is your feature request related to a problem? Please describe. When downloading a digest from a remote store, it is untrusted, and pants still needs to verify that the downloaded contents matches the digest. This currently means doing an explicit hashing pass over the data. The downloading process is already doing a pass over the data to copy from network to file/memory, and thus could be hashing the data as it goes. Describe the solution you'd like In #17065 (comment):

But that would use more passes over the data than we strictly need. We do need to re-compute and validate the Digest of the data (because we don't immediately trust the data that we get over the wire), but the Digest could be computed while writing the data to the temporary file, rather than via reading it in two passes as fn store will do.

Describe alternatives you've considered N/A Additional context #18054 is related. pants/src/rust/engine/fs/store/src/remote.rs Lines 458 to 469 in </pantsbuild/pants/commit/763191382d67343959c518e5eefd809ed5480ded|7631913> could be adjusted to feed a hashing writer down into

load_monomorphic

. pantsbuild/pants