Feature Request: Trust lockfile for vendored pnpm deployments

未關閉
  • 哪裡不對？
#978 0 則留言 0 個 reaction 已指派 0 人 在 GitHub 檢視

維護者通常 1 天內回覆

還沒有人認領這個 Issue。

評估

難度
3/5
預估耗時
1-2 天
新手友好度
55/100
Issue 類型
功能
描述清晰度
基本清楚
活躍度
活躍
技術堆疊
go, node.js
領域
build-system

研究方向

Read pnpm.go and the handling of IsVendored around the pnpm rebuild --recursive command. Compare the two proposed trust approaches and check how existing buildpack tests cover vendored pnpm deployments. Done means the maintainers' preferred behavior is implemented and covered for both vendored and non-vendored deployments.

由索引模型根據 Issue 內容生成。

描述

Context

When deploying a Node.js application to Cloud Foundry using pnpm deploy (non-legacy mode),
the generated pnpm-lock.yaml in the deploy directory records tarball URLs from the private
registry used during the CI build (e.g. GitHub Packages, Nexus, Artifactory, etc.).

When the buildpack runs pnpm rebuild --recursive (which is OK),
pnpm re-verifies every lockfile entry against the public registry (registry.npmjs.org).
This fails with:

ERR_PNPM_TARBALL_URL_MISMATCH

because the tarball URLs in the lockfile point to the private registry, not to npmjs.org.

This affects any project that uses a private registry (GitHub Packages, Nexus, Artifactory,
etc.), vendors dependencies via pnpm deploy, and deploys to Cloud Foundry.

Discussion

Option A — --trust-lockfile by default for vendored deployments

In pnpm.go, pass --trust-lockfile to pnpm rebuild whenever IsVendored == true:

cmd := exec.Command("pnpm", "rebuild", "--recursive", "--trust-lockfile")

Rationale: The logic is consistent with the intent of #964 itself. If the buildpack
already trusts node_modules/ enough to skip the install phase, it should equally trust
the lockfile that produced those node_modules/. A vendored deployment is by definition
a pre-audited artifact — the trust boundary is the zip, not the staging container.

Drawback: It removes supply-chain re-verification unconditionally for all vendored
deployments, which may not be desirable for all users.

Option B — Opt-in via environment variable

Introduce a NODE_PNPM_TRUST_LOCKFILE=true environment variable that the user can set
on their CF application when using a private registry:

if os.Getenv("NODE_PNPM_TRUST_LOCKFILE") == "true" {
    cmd := exec.Command("pnpm", "rebuild", "--recursive", "--trust-lockfile")
} else {
    cmd := exec.Command("pnpm", "rebuild", "--recursive")
}

Set it in manifest.yml or MTA descriptor:

env:
  NODE_PNPM_TRUST_LOCKFILE: "true"

Rationale: The buildpack is a generic tool used across many different projects and
organisations. Making trust opt-in keeps the default conservative and lets each team
make an explicit, reviewable decision. The environment variable is visible in the
application manifest, making it auditable.

Summary

Option A Option B
Implementation effort Minimal Minimal
Breaking change No No
Auditable / explicit No Yes
Works for private registries ✅ ✅
Safe as a generic default ⚠️ ✅

We would be happy to contribute a PR for whichever approach the maintainers prefer.

Related

  • #942 — Add pnpm package manager support
  • #964 — Fix vendored pnpm deployments calling pnpm install instead of pnpm rebuild
主要語言
Go
星號
173
分支
390
平均合併
2 天 24 分鐘
30 天內合併 PR
23

環境準備

從這裡開始

  1. 先讀完整個 Issue，再讀專案的貢獻指南。
  2. 在 Issue 下留言說明你要接手 —— 這能避免兩個人做同樣的事。
  3. Fork 儲存庫，在一個分支上完成修改。
  4. 送出 Pull Request，並在描述裡引用這個 Issue 編號。

cloudfoundry/nodejs-buildpack 的其他 Issue

查看 cloudfoundry/nodejs-buildpack 的全部 Issue

相似的 Issue

更多 Go Issue

把新 issue 寄到你的電子郵件信箱

精選適合新手參與的 GitHub issue 摘要。