feat(selections): Add the ability to read integrity tag from selections#3026
Merged
Geod24 merged 1 commit intodlang:masterfrom May 14, 2025
Merged
feat(selections): Add the ability to read integrity tag from selections#3026Geod24 merged 1 commit intodlang:masterfrom
Geod24 merged 1 commit intodlang:masterfrom
Conversation
|
✅ PR OK, no changes in deprecations or warnings Total deprecations: 0 Total warnings: 0 Build statistics: statistics (-before, +after)
-executable size=5055872 bin/dub
-rough build time=60s
+executable size=5105200 bin/dub
+rough build time=61sFull build output |
Member
Author
|
Testing (with the Then I changed the selections file to have I also attempted to build with an earlier This shows as a warning but doesn't impair functionality. |
CyberShadow
approved these changes
May 14, 2025
Member
CyberShadow
left a comment
CyberShadow
left a comment
There was a problem hiding this comment.
Great! Thank you very much for working on this!
Approving as even just the ability to understand and verify hashes is useful on its own - with this, we could start adding them to dub.selections.json manually or with third-party tools.
Code LGTM beyond the obvious syntax error.
Member
Author
|
Another example while building: diff --git a/dub.selections.json b/dub.selections.json
index 1732d821..299bf252 100644
--- a/dub.selections.json
+++ b/dub.selections.json
@@ -9,8 +9,8 @@
"stdx-allocator": "2.77.5",
"taggedalgebraic": "0.11.23",
"vibe-container": "1.4.0",
- "vibe-core": "2.9.6",
- "vibe-d": "0.10.1",
+ "vibe-core": {"integrity":"sha512-srDYpMJhpw0SMbDhGttu7RrLjiCXsYOZJOh8wFyxU/rOXO7Qydt+4hkG/rMJfQki3o3YnDZOMY9naXeAZutRdw==","version":"2.9.6"},
+ "vibe-d": {"integrity":"sha512-vwQ9tYTjLb981j41+3GZZUgKXm/5PlKpmY2bplRSUM8ajL03++LGm/TcfFFarJrHex8CTb5ZLWdiY1fFAOSkSw==","version":"0.10.1"},
"vibe-http": "1.2.1",
"vibe-inet": "1.1.0",
"vibe-serialization": "1.0.7", |
The `dub.selections.json` file can now contains integrity tags matching the SRI specifications, allowing dub (and other tools, e.g. Nix) to better validate that the downloaded archive matches the expected version. However, Dub will not yet write the integrity tag, as it would result in a bad user experience. Since `dub` tries hard to reuse packages present on the filesystem, doing a `dub upgrade` could wipe the integrity tag (or not populate it) if the package is already present on the system, an issue which would manifest itself quite often for popular packages. In order to solve this issue, we could store the integrity tag on disk, however this can be done in another PR as such package metadata would be useful for other purposes as well.
Geod24
force-pushed
the
mlang/IntegrityTag
branch
from
b7d198f to
1260495
Compare
Member
Author
|
Regarding writing them: We could also cheat and rely on the index having them (#3023). |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The
dub.selections.jsonfile can now contains integrity tags matching the SRI specifications, allowing dub (and other tools, e.g. Nix) to better validate that the downloaded archive matches the expected version.However, Dub will not yet write the integrity tag, as it would result in a bad user experience. Since
dubtries hard to reuse packages present on the filesystem, doing adub upgradecould wipe the integrity tag (or not populate it) if the package is already present on the system, an issue which would manifest itself quite often for popular packages.In order to solve this issue, we could store the integrity tag on disk, however this can be done in another PR as such package metadata would be useful for other purposes as well.