intersystems / intersystems/ipm

Lock file enhancement: Add unique tag to modules

Open
#1,172 1 comment 0 reactions 0 assignees View on GitHub
enhancement security
Dominant language
ObjectScript
Stars
41
Forks
29
Avg merge
23h 54m
Merged PRs (30d)
4

Description

In the initial implementation of the IPM lock file, the module definition has `name`, `version`, `repository`, and `dependencies` properties. We should add some sort of unique tag that goes along with the module that lives on the repository. The reason for this being is a scenario that a module gets replaced in a repository with a new artifact. This would lead to installing from a lock file using a different module artifact than what was on the environment the lock file was created from.

Example:
- `my-module v5.1.0` from `my-repository` is installed on instance-1
- Lock file gets created
- For some undefined reason, `my-module v5.1.0` has its artifact replaced on `my-repository` that has differences from the original `my-module v5.1.0`
- Lock file gets installed on instance-2

In this example, nothing would explicitly error, but our expectation would be for instance-1 and instance-2 to be identical when they are not

Blocked by #281

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.