Find why this generated source-record check cannot safely approve a reused file.
JavaScript
import { createHash } from "node:crypto";
export function approveSource(record, files) {
const source = files.get(record.path);
const actual = createHash("sha256").update(source).digest("hex");
if (actual !== record.sha256) return false;
if (!record.sourceUrl.startsWith("https://")) return false;
return Boolean(record.license);
}