sneak/prompts
1
0
Fork 0
Code Issues 6 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

Allow packages from the base image's own distribution unpinned (closes #72)
check / check (push) Canceled after 0s
Details

Browse Source 
A package from the pinned base image's own distribution package index
now needs no version and no hash, on sneak's answer at
#72 (comment). The
distribution is trusted, and everything else stays pinned by hash. A
package source that a Dockerfile adds itself does not get the exception.

The first rule of REPO_POLICIES.md and both checklists say so, and the
canonical Go Dockerfile's apk add line has a comment saying why it is
allowed.

Model: opus-5-5
This commit is contained in:
sneak
2026-11-03 22:11:51 +00:00
parent 229ea67434
commit ea445bce96
4 changed files with 50 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
TODO.md
+8
View File
@@ -21,6 +21,14 @@ fmt-check, and commit.
# Completed Steps
- 2026-11-03: A package from the pinned base image's own distribution package
index now needs no version and no hash
(https://git.eeqj.de/sneak/prompts/issues/72), on sneak's answer at
https://git.eeqj.de/sneak/prompts/issues/72#issuecomment-165196. The
distribution is trusted, and everything else stays pinned by hash. A package
source that a `Dockerfile` adds itself does not get the exception. The first
rule of `REPO_POLICIES.md` and both checklists say so, and the canonical Go
`Dockerfile`'s `apk add` line has a comment saying why it is allowed.
- 2026-11-03: A first test run that timed out now gets no verbose rerun
(https://git.eeqj.de/sneak/prompts/issues/61), on sneak's approval at
https://git.eeqj.de/sneak/prompts/issues/61#issuecomment-165195. The Go recipe