refactor: streamline BuildFlags initialization across multiple modules

src/package/spec.rs

@@ -1279,6 +1279,35 @@ type = "custom"
         assert_eq!(spec.sources()[1].extract_dir, "bar");
     }
 
+    #[test]
+    fn parse_source_without_sha256_defaults_to_skip() {
+        let tmp = tempfile::tempdir().unwrap();
+        let path = tmp.path().join("pkg.toml");
+
+        std::fs::write(
+            &path,
+            r#"
+[package]
+name = "foo"
+version = "1.0"
+description = "d"
+homepage = "h"
+license = "MIT"
+
+[source]
+url = "https://example.com/foo.tar.gz"
+extract_dir = "foo"
+
+[build]
+type = "custom"
+"#,
+        )
+        .unwrap();
+
+        let spec = PackageSpec::from_file(&path).unwrap();
+        assert_eq!(spec.sources()[0].sha256, "skip");
+    }
+
     #[test]
     fn parse_git_source_with_cherry_pick() {
         let tmp = tempfile::tempdir().unwrap();
@@ -2801,7 +2830,8 @@ pub struct Alternatives {
 pub struct Source {
     pub url: String,
     /// Checksum for the source (e.g. `sha256:...`, `sha512:...`, `md5:...`, or raw SHA256 hex).
-    /// Use `skip` to bypass verification.
+    /// Defaults to `skip` when omitted.
+    #[serde(default = "default_source_sha256")]
     pub sha256: String,
     /// Directory name after extraction (supports $name, $version)
     pub extract_dir: String,
@@ -2857,6 +2887,10 @@ pub struct ManualSource {
     pub dest: Option<String>,
 }
 
+fn default_source_sha256() -> String {
+    "skip".to_string()
+}
+
 #[derive(Debug, Deserialize)]
 #[serde(untagged)]
 enum OneOrManySources {