bug: `github.com` packages not supported about rules_js HOT 9 CLOSED

Thanks for the issue. I ran into this as well and we should resolve for 1.0.

from rules_js.

Hmm. That is unfortunate that there is no integrity SHA provided for these URLs.

+  github.com/dmarcos/document-register-element/8ccc532b7f3744be954574caf3072a5fd260ca90:
+    resolution: {tarball: https://codeload.github.com/dmarcos/document-register-element/tar.gz/8ccc532b7f3744be954574caf3072a5fd260ca90}
+    name: document-register-element
+    version: 0.5.4
+    dev: true

yarn doesn't either in its lockfile

"document-register-element@github:dmarcos/document-register-element#8ccc532b7f3744be954574caf3072a5fd260ca90":
  version "0.5.4"
  resolved "https://codeload.github.com/dmarcos/document-register-element/tar.gz/8ccc532b7f3744be954574caf3072a5fd260ca90"

Presumably this is because a consistent SHA is not guaranteed over time. Without a SHA, the downloaded archives won't go into the external repository cache but they shouldn't anyway if their SHA is not guaranteed to be consistent.

from rules_js.

Ah yeah, makes sense. So short term just (unfortunately) not caching it makes sense, but long term maybe it's worthwhile to add a dictionary for sha's to the npm_translate_lock call similar to patches?

I appreciate the call-out though, as I'd like to raise this with our teams as it feels like a big code-audit hole.

from rules_js.

Cut a release which includes the fix https://github.com/aspect-build/rules_js/releases/tag/v0.11.1

from rules_js.

A dictionary of SHAs sounds reasonable to fill in gaps where there is no SHA provided in the lock file.

from rules_js.

let's use 90% of our energy to push for an upstream fix, they are breaking supply chain security for everyone and it's not a bazel-specific problem...

from rules_js.

let's use 90% of our energy to push for an upstream fix, they are breaking supply chain security for everyone and it's not a bazel-specific problem...

100% agreed here, if anything (at all) is done on this side it should be minimal effort.

from rules_js.

Interesting side note: there actually is a SHA in the package-lock.json for these, it's just not getting propagated to pnpm-lock.yaml I'd guess?

"node_modules/document-register-element": {
      "version": "0.5.4",
      "resolved": "git+ssh://[email protected]/dmarcos/document-register-element.git#8ccc532b7f3744be954574caf3072a5fd260ca90",
      "integrity": "sha512-dwvGei9I/m1pYQ/9aNODyVmvSWBtlncfIROn5Sbi4MVnIcZKre5QaWx+AGLI/j6VH9sp8jwLyeuWP1micANT0g==",
      "license": "MIT"
    },

from rules_js.

Must be a pnpm bug then

from rules_js.