Repository navigation
Rewrite only the vendored Editor SDK entry in the staging install lock - #1492
Merged
Merged
Conversation
The staging install replaced the production SDK integrity globally. Since the vendored Editor SDK became byte-identical to the registry @mdbase-dev/sdk@0.1.0-beta.188 that other workspace packages resolve, the global replace also changed the registry entry's integrity, and the frozen install refused the genuine registry tarball (ERR_PNPM_TARBALL_INTEGRITY). Replace the integrity only in the vendored file: entry's own resolution, and fail closed unless that entry appears exactly once.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes the staging Editor build, which fails every time at
pnpm install --frozen-lockfilewithERR_PNPM_TARBALL_INTEGRITYfor the registry tarball of@mdbase-dev/sdk@0.1.0-beta.188. Tracked as mdbase-cloud-ops stop #1835.Cause
apps/editor/scripts/native/install-inputs.mjsbuilds the staging lock by replacing the production SDK SRI with the staging archive's SRI across the whole file. #1488 made the vendored Editor SDK (sdk-e8ffb806-production-beta188.tgz) byte-identical to the registry@mdbase-dev/sdk@0.1.0-beta.188, which other workspace packages install from npm. Both lock entries now have the same integrity, so the global replace also rewrote the registry entry, and pnpm then rejected the genuine registry tarball. Production builds don't apply this rewrite.Change
file:entry's ownresolutionline. No other package's resolution is touched, even if it has the same integrity.Tests
@mdbase-dev/sdkentry shares the production SRI. It asserts that only the vendored entry changes (registry entry and importer stay unchanged) and that a missing or duplicated vendored entry is refused without writing the lock.pnpm ci:localpasses. The Editor native-script tests pass exceptsecurity.test.mjs"cryptographically refuses a real public npm bundle…", which also fails on unmodified main locally (the local global npm has nosigstoremodule) and is unrelated.