Deterministic/reproducible packaging for `Compress-PSResource`

Abierto
#2,047 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
5/5
Tiempo estimado
Más de una semana
Aptitud para principiantes
45/100
Tipo de issue
Nueva funcionalidad
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
csharp, powershell
Área
cli, tooling

Línea de trabajo

Begin at the Compress-PSResource entry point and trace package generation, including timestamps, PSMDCP naming, .rels, and [Content_Types].xml ordering. Done means default output is reproducible and -Timestamp applies to all packaged files, with deterministic names and XML ordering.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

feature_request Needs-Triage
Summary of the new feature / enhancement

Deterministic/reproducible builds are an undeniably important feature for auditability and security. Currently, Compress-PSResource doesn't provide support for that, and it should.

Currently, I post-process my packages to ensure fully reproducible output, which takes significant time in a build.

Proposed technical implementation details (optional)

There are a few sources of non-determinism I have observed in Compress-PSResource:

  • The timestamps of files in the zipped package.
  • The PSMDCP file name is non-deterministic. Consequently, the .rels file content is non-deterministic.
  • The [Content_Types].xml content, notably the order of children, is non-deterministic. (? I remember observing this but couldn't give a stable reproduction at the moment.)

Suggestion.

  1. Make Compress-PSResource deterministic by default. PSMDCP name can be a hash of non-.rels non-.psmdcp files, and [Content_Types].xml children should be sorted.
  2. Provide a new parameter -Timestamp. When this parameter is set, all files in the package should use this timestamp.
Lenguaje dominante
C#
Estrellas
576
Forks
114
Merge medio
1 d 2 h
PR fusionados (30 d)
7

Guía de contribución

Abrir la guía de contribución

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de PowerShell/PSResourceGet

Todos los issues de PowerShell/PSResourceGet

Issues similares

Más issues de C#

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.