Project

Profile

Help

Story #4690

Implement package locking / digest specification

Added by dalley 6 months ago. Updated 6 months ago.

Status:
NEW
Priority:
Normal
Assignee:
-
Category:
-
Sprint/Milestone:
-
Start date:
Due date:
% Done:

0%

Platform Release:
Blocks Release:
Target Release - Python:
Backwards Incompatible:
No
Groomed:
No
Sprint Candidate:
No
Tags:
QA Contact:
Complexity:
Smash Test:
Verified:
No
Verification Required:
No
Sprint:

Description

There are two primary ways that I can forsee implementing this.

  1. Either make a self-contained object that can be created from pipenv.lock, or something similar, which contains a full listing of all packages, their versions, and their digests being used, and allow it to be linked to the remote and supplement or take the place of the remote's own include and exclude settings when being used, or
  2. Make a separate field called "locked_versions", that would supplement or take the place of the includes or excludes fields when being used

Both of these designs would:

  • Simplify the sync codepaths dramatically
  • Enforce the fact that digests only make sense in the context of a single release
  • Provide more guarantees to the repo owner that when they are using digests for reproducability, they have a solid guarantee that the entire contents of the repository is the reproducable set

They would also:

  • Make it possible to simplify the format of "includes" and "excludes".
  • We could let them accept an array of requirements.txt-style strings instead of dictionaries. e.g. includes:='["django>=1,<=2.1,==2.3", "flask==2.0.1", "bottle~=3.2"]'
  • This might be a little harder to validate so maybe we wouldn't do this, but it's possible and I think it would make Pulp feel a lot more familiar
  • Open up the possibility for adding various strict modes
  • maybe in strict mode, you're only allowed to have one release per project (with or without providing digests)
  • maybe in strict mode, you're only allowed to have locked versions on the remote (no using includes/excludes), and providing hashes is enforced for all locked versions, similar to how pip behaves in hash-checking mode

History

#1 Updated by dalley 6 months ago

  • Description updated (diff)

#2 Updated by dalley 6 months ago

  • Description updated (diff)

#3 Updated by dalley 6 months ago

  • Subject changed from Change the way digest specification works to better match how the ecosystem works to Implement package locking / digest specification
  • Description updated (diff)

#4 Updated by bmbouter 6 months ago

  • Tags deleted (Pulp 3)

Please register to edit this issue

Also available in: Atom PDF