@grosspoetrysystems/oompf 0.2.0 → 0.2.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/index.mjs +12 -3
- package/dist/index.mjs.map +1 -1
- package/package.json +1 -1
package/dist/index.mjs
CHANGED
|
@@ -11,7 +11,7 @@ var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).expor
|
|
|
11
11
|
var __require = /* #__PURE__ */ (() => createRequire(import.meta.url))();
|
|
12
12
|
//#endregion
|
|
13
13
|
//#region package.json
|
|
14
|
-
var version = "0.2.
|
|
14
|
+
var version = "0.2.1";
|
|
15
15
|
//#endregion
|
|
16
16
|
//#region ../../packages/core/src/guards.ts
|
|
17
17
|
/**
|
|
@@ -8164,8 +8164,17 @@ function registerAdd(cli, deps) {
|
|
|
8164
8164
|
try {
|
|
8165
8165
|
const oompfId = parseOompfRef(c.args.ref);
|
|
8166
8166
|
let sourceUrl = c.args.ref;
|
|
8167
|
-
|
|
8168
|
-
|
|
8167
|
+
let fetchUrl = sourceUrl;
|
|
8168
|
+
let expectedHash = null;
|
|
8169
|
+
if (oompfId !== null) {
|
|
8170
|
+
const record = await fetchProfileMetadata(c.env.OOMPF_BASE_URL, oompfId, deps.httpFetch);
|
|
8171
|
+
if (record.revision === null) throw new CommandError("unverifiable_artifact", "The indexed profile has no pinned revision and cannot be installed reproducibly.");
|
|
8172
|
+
sourceUrl = record.sourceUrl;
|
|
8173
|
+
fetchUrl = `https://api.github.com/gists/${record.gistId}/${record.revision}`;
|
|
8174
|
+
expectedHash = record.contentHash;
|
|
8175
|
+
}
|
|
8176
|
+
const gist = await fetchPublicGist(fetchUrl, { fetch: deps.gistFetch });
|
|
8177
|
+
if (expectedHash !== null && gist.contentHash !== expectedHash) throw new CommandError("fingerprint_mismatch", "The pinned profile bytes do not match the indexed fingerprint. Refusing to install.");
|
|
8169
8178
|
const validation = validateArtifact({ yaml: gist.content });
|
|
8170
8179
|
if (validation.structural === "invalid") throw new CommandError("invalid_artifact", `Refusing to install an invalid artifact: ${validation.errors.join("; ")}`);
|
|
8171
8180
|
const stem = filenameStem$1(gist.filename);
|