wolfi-dev / wolfi-dev/wolfictl
lint: add new lint to check if `uri` contains any hard-coded digests
Open
@rawlingsj is already working on this.
Since Aug 19, 2023.
enhancement
needs-triage
- Dominant language
- Go
- Stars
- 73
- Forks
- 86
- Avg merge
- 7d 7h
- Merged PRs (30d)
- 15
Description
Description
melange convert python <PACKAGE> generated melange manifest, sometimes contains the digest in the uri:
- uses: fetch
with:
expected-sha256: 942c5a758f98d790eaed1a29cb6eefc7ffb0d1cf7af05c3d2791656dbd6ad1e1
uri: https://files.pythonhosted.org/packages/9d/be/10918a2eac4ae9f02f6cfe6414b7a155ccd8f7f9d4380d62fd5b955065c3/requests-${{package.version}}.tar.gz
So that contains a SHA means that the Wolfi bot won't be able to auto-update the package.
AFAICSC, the following packages has affected:
- py3-aiohttp
- py3-aiosignal
- py3-async-timeout
- py3-asynctest
- py3-attrs
- py3-frozenlist
- py3-idna-ssl
- py3-idna
- py3-llhttp
- py3-multidict
- py3-openai
- py3-pyperclip
- py3-requests
- py3-ruamel-yaml
- py3-tqdm
- py3-typing
- py3-yarl
cc @rawlingsj
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.