Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

Feature Request: Trust lockfile for vendored pnpm deployments

Abierto
  • ¿Algo no está bien?
#978 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 5 días

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
3/5
Tiempo estimado
1-2 días
Aptitud para principiantes
55/100
Tipo de issue
Nueva funcionalidad
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
go, node.js
Área
build-system

Línea de trabajo

Read pnpm.go and the handling of IsVendored around the pnpm rebuild --recursive command. Compare the two proposed trust approaches and check how existing buildpack tests cover vendored pnpm deployments. Done means the maintainers' preferred behavior is implemented and covered for both vendored and non-vendored deployments.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Context

When deploying a Node.js application to Cloud Foundry using pnpm deploy (non-legacy mode),
the generated pnpm-lock.yaml in the deploy directory records tarball URLs from the private
registry used during the CI build (e.g. GitHub Packages, Nexus, Artifactory, etc.).

When the buildpack runs pnpm rebuild --recursive (which is OK),
pnpm re-verifies every lockfile entry against the public registry (registry.npmjs.org).
This fails with:

ERR_PNPM_TARBALL_URL_MISMATCH

because the tarball URLs in the lockfile point to the private registry, not to npmjs.org.

This affects any project that uses a private registry (GitHub Packages, Nexus, Artifactory,
etc.), vendors dependencies via pnpm deploy, and deploys to Cloud Foundry.

Discussion

Option A — --trust-lockfile by default for vendored deployments

In pnpm.go, pass --trust-lockfile to pnpm rebuild whenever IsVendored == true:

cmd := exec.Command("pnpm", "rebuild", "--recursive", "--trust-lockfile")

Rationale: The logic is consistent with the intent of #964 itself. If the buildpack
already trusts node_modules/ enough to skip the install phase, it should equally trust
the lockfile that produced those node_modules/. A vendored deployment is by definition
a pre-audited artifact — the trust boundary is the zip, not the staging container.

Drawback: It removes supply-chain re-verification unconditionally for all vendored
deployments, which may not be desirable for all users.

Option B — Opt-in via environment variable

Introduce a NODE_PNPM_TRUST_LOCKFILE=true environment variable that the user can set
on their CF application when using a private registry:

if os.Getenv("NODE_PNPM_TRUST_LOCKFILE") == "true" {
    cmd := exec.Command("pnpm", "rebuild", "--recursive", "--trust-lockfile")
} else {
    cmd := exec.Command("pnpm", "rebuild", "--recursive")
}

Set it in manifest.yml or MTA descriptor:

env:
  NODE_PNPM_TRUST_LOCKFILE: "true"

Rationale: The buildpack is a generic tool used across many different projects and
organisations. Making trust opt-in keeps the default conservative and lets each team
make an explicit, reviewable decision. The environment variable is visible in the
application manifest, making it auditable.

Summary

Option A Option B
Implementation effort Minimal Minimal
Breaking change No No
Auditable / explicit No Yes
Works for private registries ✅ ✅
Safe as a generic default ⚠️ ✅

We would be happy to contribute a PR for whichever approach the maintainers prefer.

Related

  • #942 — Add pnpm package manager support
  • #964 — Fix vendored pnpm deployments calling pnpm install instead of pnpm rebuild
Lenguaje dominante
Go
Estrellas
173
Forks
390
Merge medio
2 d 22 h
PR fusionados (30 d)
23

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de cloudfoundry/nodejs-buildpack

Todos los issues de cloudfoundry/nodejs-buildpack

Issues similares

Más issues de Go

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.