A Meson wrap file tells the build how to fetch a dependency into the subprojects directory. For archive downloads it can carry a sha256 checksum for the source and for any patch overlay, and Meson checks the file's hash. A wrap without a hash is a download you are trusting blindly.
What a wrap file holds
Per the Meson wrap manual, wrap files are named after the project, end in .wrap, and live in the subprojects directory. A typical archive wrap names a source_url and a source_hash, the sha256 checksum of the downloaded source archive. It may also name a patch_url and patch_hash for an optional overlay archive, a source_fallback_url used when the first download fails, and local diff files applied after the overlay.
The manual also says that if a source or patch file already sits in subprojects/packagecache, that file is used instead of a download, and its hash is still checked.
Wraps can also point at a git repository with a revision, which the manual says must be a branch, tag or commit. That is a different trust model, covered below.
What the hash does and does not prove
A hash proves the file you got matches the one the wrap author recorded. It does not prove the upstream release is safe, only that it did not change between the day the wrap was written and today. If the wrap author recorded a bad file, the hash will faithfully verify the bad file.
| Wrap type | Pinned by | Weak spot |
|---|---|---|
| Archive | source_hash | Hash recorded from an untrusted source |
| Git | revision | A branch name moves, a commit does not |
| Patch overlay | patch_hash | Overlay can change code you think is upstream |
Review checklist for a wrap file change
- Does every archive wrap have a source_hash, and every overlay a patch_hash?
- Does the revision of a git wrap point to a commit rather than a branch? See pin FetchContent to a commit hash for the same idea in CMake.
- Where did the hash value come from? Ask the author to cite the upstream release page or signature.
- Is a fallback URL pointing somewhere you control or trust?
- Do the patch or diff files change security relevant code? They are your fork in disguise, so keep them visible in review.
- Record the library version somewhere a scanner can read it, because the wrap file alone may not say.
Scanner blind spots
Subproject sources fetched at configure time do not appear in a lockfile. A scanner that reads only package manifests will miss them. This is the same issue as in does CMake FetchContent hide dependencies from scanners.
Safeguard's dependency scanning and SBOM generation can inventory the libraries in a repository, and the free scan at gold.safeguard.sh/scan shows what it finds in yours.
Quick check
Which field holds the source checksum?
The source_hash field, a sha256 checksum of the downloaded source archive.
Is a cached file in packagecache trusted without a hash check?
No. The Meson manual says the file's hash will be checked.
Sources
Last reviewed: 19 October 2026.
