Hacktoberfest 2026 : les issues que les mainteneurs ont marquées pour octobre, ouvertes et accessibles aux débutants. Parcourir les issues Hacktoberfest

Feature Request: Trust lockfile for vendored pnpm deployments

Ouverte
  • Quelque chose ne va pas ?
#978 0 commentaires 0 réactions 0 personnes assignées Voir sur GitHub

Les mainteneurs répondent en général sous 5 jours

Personne n'a encore pris cette issue.

Évaluation

Difficulté
3/5
Temps estimé
1-2 jours
Accessibilité débutants
55/100
Type d'issue
Fonctionnalité
Clarté
Plutôt claire
Activité
Active
Stack technique
go, node.js
Domaine
build-system

Piste de recherche

Read pnpm.go and the handling of IsVendored around the pnpm rebuild --recursive command. Compare the two proposed trust approaches and check how existing buildpack tests cover vendored pnpm deployments. Done means the maintainers' preferred behavior is implemented and covered for both vendored and non-vendored deployments.

Rédigé par le modèle d'indexation à partir du texte de l'issue.

Description

Context

When deploying a Node.js application to Cloud Foundry using pnpm deploy (non-legacy mode),
the generated pnpm-lock.yaml in the deploy directory records tarball URLs from the private
registry used during the CI build (e.g. GitHub Packages, Nexus, Artifactory, etc.).

When the buildpack runs pnpm rebuild --recursive (which is OK),
pnpm re-verifies every lockfile entry against the public registry (registry.npmjs.org).
This fails with:

ERR_PNPM_TARBALL_URL_MISMATCH

because the tarball URLs in the lockfile point to the private registry, not to npmjs.org.

This affects any project that uses a private registry (GitHub Packages, Nexus, Artifactory,
etc.), vendors dependencies via pnpm deploy, and deploys to Cloud Foundry.

Discussion

Option A — --trust-lockfile by default for vendored deployments

In pnpm.go, pass --trust-lockfile to pnpm rebuild whenever IsVendored == true:

cmd := exec.Command("pnpm", "rebuild", "--recursive", "--trust-lockfile")

Rationale: The logic is consistent with the intent of #964 itself. If the buildpack
already trusts node_modules/ enough to skip the install phase, it should equally trust
the lockfile that produced those node_modules/. A vendored deployment is by definition
a pre-audited artifact — the trust boundary is the zip, not the staging container.

Drawback: It removes supply-chain re-verification unconditionally for all vendored
deployments, which may not be desirable for all users.

Option B — Opt-in via environment variable

Introduce a NODE_PNPM_TRUST_LOCKFILE=true environment variable that the user can set
on their CF application when using a private registry:

if os.Getenv("NODE_PNPM_TRUST_LOCKFILE") == "true" {
    cmd := exec.Command("pnpm", "rebuild", "--recursive", "--trust-lockfile")
} else {
    cmd := exec.Command("pnpm", "rebuild", "--recursive")
}

Set it in manifest.yml or MTA descriptor:

env:
  NODE_PNPM_TRUST_LOCKFILE: "true"

Rationale: The buildpack is a generic tool used across many different projects and
organisations. Making trust opt-in keeps the default conservative and lets each team
make an explicit, reviewable decision. The environment variable is visible in the
application manifest, making it auditable.

Summary

Option A Option B
Implementation effort Minimal Minimal
Breaking change No No
Auditable / explicit No Yes
Works for private registries ✅ ✅
Safe as a generic default ⚠️ ✅

We would be happy to contribute a PR for whichever approach the maintainers prefer.

Related

  • #942 — Add pnpm package manager support
  • #964 — Fix vendored pnpm deployments calling pnpm install instead of pnpm rebuild
Langage dominant
Go
Étoiles
173
Forks
390
Merge moyen
2 j 22 h
PR mergées (30 j)
23

Préparer son environnement

Par où commencer

  1. Lisez l'issue en entier, puis le guide de contribution du projet.
  2. Signalez en commentaire que vous la prenez — cela évite que deux personnes fassent le même travail.
  3. Forkez le dépôt et travaillez sur une branche.
  4. Ouvrez une pull request qui référence le numéro de l'issue.

Autres issues de cloudfoundry/nodejs-buildpack

Toutes les issues de cloudfoundry/nodejs-buildpack

Issues similaires

Plus d'issues Go

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.