A comprehensive survey of how content addressing (identifying data by cryptographic hash) appears throughout the package management ecosystem. Covers what gets hashed at each layer: individual files within packages (pnpm, OCI), single distributed artifacts (lockfiles across npm, Cargo, Go, PyPI, etc.), resolved dependency graphs, per-package version histories, full registry indexes, build inputs, and metadata/attestations. Explains the difference between verification (checking after fetch) and addressing (fetching by hash), plus deduplication, build caching, and tamper evidence via Merkle structures. Also discusses the challenge of archive encoding sensitivity, canonical serialization formats (Go dirhash, Nix NAR), hash algorithm agility, and the fundamental limitation that content addressing only confirms you received what was published — not that the binding from name to hash is trustworthy, which is where supply chain attacks actually occur.
