Found in review of #145. sneak's answer on #72 (comment) trusts the distribution's own package index and says PyPI, npm and go get need hashes. Canonical files at next still fetch these without a hash of ours:
script/bootstrap installs yarn from npm by version (corepack prepare yarn@<version>, lines 133, 139 and 141). prompts/REPO_POLICIES.md calls this pinned.
script/bootstrap installs node with nvm install by version (line 125).
script/bootstrap takes base tools from nix and brew on a host. Neither is a distribution package index.
The Python test phase: pip downloads build tools without a hash check when a package has no wheel. prompts/REPO_POLICIES.md states this as a known gap.
Definition of done
Each is pinned by hash, or the policy states why it is not, on sneak's ruling where the rule leaves a real choice.
Every copy of script/bootstrap in this repository stays byte-identical.
Model: opus-5-5
Found in review of https://git.eeqj.de/sneak/prompts/pulls/145. sneak's answer on https://git.eeqj.de/sneak/prompts/issues/72#issuecomment-165196 trusts the distribution's own package index and says PyPI, npm and `go get` need hashes. Canonical files at `next` still fetch these without a hash of ours:
- `script/bootstrap` installs yarn from npm by version (`corepack prepare yarn@<version>`, lines 133, 139 and 141). `prompts/REPO_POLICIES.md` calls this pinned.
- `script/bootstrap` installs node with `nvm install` by version (line 125).
- `script/bootstrap` takes base tools from nix and brew on a host. Neither is a distribution package index.
- The Python `test` phase: pip downloads build tools without a hash check when a package has no wheel. `prompts/REPO_POLICIES.md` states this as a known gap.
**Definition of done**
- Each is pinned by hash, or the policy states why it is not, on sneak's ruling where the rule leaves a real choice.
- Every copy of `script/bootstrap` in this repository stays byte-identical.
Model: opus-5-5
Whenever and wherever possible, node and yarn and npm and python and the Python installer tools that are bundled with it should be installed from the distribution. And we don't need to worry about hashes. We trust the distribution and its packet ma package manager. All of the other third party stuff like Python packages, Go modules, node packages, etc., all need to be version pinned by hash, but the actual runtimetimes themselves are okay to be installed from the distribution. If they're too far out of date, then we need to use a newer distribution.
Whenever and wherever possible, node and yarn and npm and python and the Python installer tools that are bundled with it should be installed from the distribution. And we don't need to worry about hashes. We trust the distribution and its packet ma package manager. All of the other third party stuff like Python packages, Go modules, node packages, etc., all need to be version pinned by hash, but the actual runtimetimes themselves are okay to be installed from the distribution. If they're too far out of date, then we need to use a newer distribution.
Implementer's brief for sneak's ruling at #146 (comment). One PR, base next. It supersedes the definition of done above where they differ.
The rule, stated once and agreed everywhere
node, yarn, npm, python and the installer tools bundled with python (pip, venv) come from the distribution's package manager wherever possible, with no version and no hash, because the distribution is trusted.
Every third-party package (Python packages, Go modules, node packages and the like) stays pinned by version and hash.
If the distribution's runtime is too old, the answer is a newer distribution, never a download. nvm, pyenv, corepack and npm install -g yarn go.
This merges with the exception built for #72 in the first rule of prompts/REPO_POLICIES.md: one rule, no second exception beside it. A package source a Dockerfile adds itself still does not count.
script/bootstrap (edits by hand; stays one file, no new scripts)
Delete NODE_VERSION, NVM_VERSION, NVM_SHA256, YARN_VERSION, verify_sha256, nvm_sh, ensure_nvm, node_is_pinned_major and the corepack and npm paths.
node: when missing, pkg_install nodejs nodejs node nodejs. yarn: when both yarn and yarnpkg are missing, pkg_install yarn yarnpkg yarn yarn. There is no version to compare, so a presence test is enough.
Debian and Ubuntu name the command yarnpkg, not yarn. script/bootstrap, script/fmt and script/fmt-check each carry the same small function that runs whichever is present. script/fmt and script/fmt-check lose their nvm path and NODE_VERSION.
Debian 13 and Ubuntu 26.04 package yarn 4.1.0, and I tried it: with --frozen-lockfile or --immutable it refuses a yarn 1 yarn.lock, and without them it rewrites the file and drops the hashes. Alpine has yarn 1.22.22 and no yarn 4, and Ubuntu 24.04 (the CI runner image) has 1.22.19. So script/bootstrap stops with a one-line message when yarn's major version is not 1, before installing anything, and leaves the tree clean. Yarn 4 on Debian may write .yarnrc.yml when run; check that the version test does not. Keep yarn install --frozen-lockfile.
nix and brew stay: on a host, the host's package manager stands for its distribution. Say so in the policy in one sentence and disclose it in the PR.
This repository's Dockerfile
Each stage starts from a digest-pinned Alpine image, not node. Right after FROM, above ARG CACHEBUST, RUN apk add --no-cache git make nodejs yarn, so check builds keep that layer, the way the policy already places system packages. Correct the header comment that says ARG CACHEBUST comes first. Keep the version and date comment above each FROM.
Which Alpine: 3.22 has node 22, 3.23 has node 24, and the old comment says yarn 1 warns under node 24. Try the newest release first and take the newest where yarn install and prettier print no deprecation warning. Name the choice in the PR.
Example Dockerfiles in prompts/REPO_POLICIES.md
The Python example starts from a digest-pinned distribution image such as debian:trixie-slim, not python, and installs python3 python3-pip python3-venv with make and git above ARG CACHEBUST. It uses --no-install-recommends, so it needs ca-certificates too, or every download fails on TLS (I hit this). Debian's python refuses a system-wide pip install, so pipenv goes into a virtual environment the example creates. pipenv is not bundled with python, so it stays installed by hash. Build this example on a scratch repository and make it pass before writing it down. Fix every sentence around it that says the image's hash pins Python.
The known gap goes: pip must not download build tools without a hash check. Set PIP_ONLY_BINARY=:all: for the install, so a package with no wheel for the image stops the install instead. State this in the policy and disclose it as a judgement call. Check that it reaches pip when run through pipenv.
The Go examples are unchanged: the ruling does not name Go. golang and golangci-lint stay pinned by digest. Disclose in one line.
Everywhere else
Both copies of the policy (REPO_POLICIES.md, prompts/REPO_POLICIES.md) stay byte-identical. Both checklists agree. last_modified and a new top entry in TODO.md's Completed Steps; older entries are history, so leave them.
In the policy, find and fix at least: the curl | bash sentence that names pyenv and nvm (rustup stays as the example); the script/bootstrap paragraph; "Never install latest or lts; always exact versions" (true now only of tools outside the distribution); "The bootstrap alone is not enough" (bootstrap now leaves node and yarn on PATH, so this paragraph goes, but script/cibuild still bootstraps first); "Node is the exception to the whole-token comparison".
Then search the tree for nvm, corepack, pinned node, pinned yarn, pinned major, NODE_VERSION, node 22 and python@ and leave nothing that disagrees, TODO.md history aside. Do not touch script/lint or script/test, whose comments are #141.
Must work, tried in fresh containers, each with --rm (keep results off the tracker)
The runner image docker.gitea.com/runner-images:ubuntu-latest, with the docker socket: git clone inside the container, so no root-owned files land in your temp directory, then script/cibuild. It must pass with no yarn on PATH at the start.
The chosen Alpine: script/bootstrap, script/fmt-check.
debian:trixie-slim and ubuntu:26.04: script/bootstrap stops with the message, tree clean.
nix and brew cannot be run here; disclose that as partially verified.
make check on the current next head.
Prose: the policy was just rewritten sentence by sentence. New sentences keep that bar: short, one idea each, lists as bullets, no coined terms. #147 already merged, so this rewrites that text directly.
Close this issue with the landing commit, title ending (closes #146).
Model: opus-5-5
Implementer's brief for sneak's ruling at https://git.eeqj.de/sneak/prompts/issues/146#issuecomment-166033. One PR, base `next`. It supersedes the definition of done above where they differ.
**The rule, stated once and agreed everywhere**
- node, yarn, npm, python and the installer tools bundled with python (pip, venv) come from the distribution's package manager wherever possible, with no version and no hash, because the distribution is trusted.
- Every third-party package (Python packages, Go modules, node packages and the like) stays pinned by version and hash.
- If the distribution's runtime is too old, the answer is a newer distribution, never a download. nvm, pyenv, corepack and `npm install -g yarn` go.
- This merges with the exception built for https://git.eeqj.de/sneak/prompts/issues/72 in the first rule of `prompts/REPO_POLICIES.md`: one rule, no second exception beside it. A package source a `Dockerfile` adds itself still does not count.
**`script/bootstrap`** (edits by hand; stays one file, no new scripts)
- Delete `NODE_VERSION`, `NVM_VERSION`, `NVM_SHA256`, `YARN_VERSION`, `verify_sha256`, `nvm_sh`, `ensure_nvm`, `node_is_pinned_major` and the corepack and npm paths.
- node: when missing, `pkg_install nodejs nodejs node nodejs`. yarn: when both `yarn` and `yarnpkg` are missing, `pkg_install yarn yarnpkg yarn yarn`. There is no version to compare, so a presence test is enough.
- Debian and Ubuntu name the command `yarnpkg`, not `yarn`. `script/bootstrap`, `script/fmt` and `script/fmt-check` each carry the same small function that runs whichever is present. `script/fmt` and `script/fmt-check` lose their nvm path and `NODE_VERSION`.
- Debian 13 and Ubuntu 26.04 package yarn 4.1.0, and I tried it: with `--frozen-lockfile` or `--immutable` it refuses a yarn 1 `yarn.lock`, and without them it rewrites the file and drops the hashes. Alpine has yarn 1.22.22 and no yarn 4, and Ubuntu 24.04 (the CI runner image) has 1.22.19. So `script/bootstrap` stops with a one-line message when yarn's major version is not 1, before installing anything, and leaves the tree clean. Yarn 4 on Debian may write `.yarnrc.yml` when run; check that the version test does not. Keep `yarn install --frozen-lockfile`.
- nix and brew stay: on a host, the host's package manager stands for its distribution. Say so in the policy in one sentence and disclose it in the PR.
**This repository's `Dockerfile`**
- Each stage starts from a digest-pinned Alpine image, not `node`. Right after `FROM`, above `ARG CACHEBUST`, `RUN apk add --no-cache git make nodejs yarn`, so check builds keep that layer, the way the policy already places system packages. Correct the header comment that says `ARG CACHEBUST` comes first. Keep the version and date comment above each `FROM`.
- Which Alpine: 3.22 has node 22, 3.23 has node 24, and the old comment says yarn 1 warns under node 24. Try the newest release first and take the newest where yarn install and prettier print no deprecation warning. Name the choice in the PR.
**Example Dockerfiles in `prompts/REPO_POLICIES.md`**
- The Python example starts from a digest-pinned distribution image such as `debian:trixie-slim`, not `python`, and installs `python3 python3-pip python3-venv` with `make` and `git` above `ARG CACHEBUST`. It uses `--no-install-recommends`, so it needs `ca-certificates` too, or every download fails on TLS (I hit this). Debian's python refuses a system-wide `pip install`, so pipenv goes into a virtual environment the example creates. pipenv is not bundled with python, so it stays installed by hash. Build this example on a scratch repository and make it pass before writing it down. Fix every sentence around it that says the image's hash pins Python.
- The known gap goes: pip must not download build tools without a hash check. Set `PIP_ONLY_BINARY=:all:` for the install, so a package with no wheel for the image stops the install instead. State this in the policy and disclose it as a judgement call. Check that it reaches pip when run through pipenv.
- The Go examples are unchanged: the ruling does not name Go. `golang` and `golangci-lint` stay pinned by digest. Disclose in one line.
**Everywhere else**
- Both copies of the policy (`REPO_POLICIES.md`, `prompts/REPO_POLICIES.md`) stay byte-identical. Both checklists agree. `last_modified` and a new top entry in `TODO.md`'s Completed Steps; older entries are history, so leave them.
- In the policy, find and fix at least: the `curl | bash` sentence that names pyenv and nvm (rustup stays as the example); the `script/bootstrap` paragraph; "Never install latest or lts; always exact versions" (true now only of tools outside the distribution); "The bootstrap alone is not enough" (bootstrap now leaves node and yarn on `PATH`, so this paragraph goes, but `script/cibuild` still bootstraps first); "Node is the exception to the whole-token comparison".
- Then search the tree for `nvm`, `corepack`, `pinned node`, `pinned yarn`, `pinned major`, `NODE_VERSION`, `node 22` and `python@` and leave nothing that disagrees, `TODO.md` history aside. Do not touch `script/lint` or `script/test`, whose comments are https://git.eeqj.de/sneak/prompts/issues/141.
**Must work, tried in fresh containers, each with `--rm`** (keep results off the tracker)
- The runner image `docker.gitea.com/runner-images:ubuntu-latest`, with the docker socket: `git clone` inside the container, so no root-owned files land in your temp directory, then `script/cibuild`. It must pass with no yarn on `PATH` at the start.
- The chosen Alpine: `script/bootstrap`, `script/fmt-check`.
- `debian:trixie-slim` and `ubuntu:26.04`: `script/bootstrap` stops with the message, tree clean.
- nix and brew cannot be run here; disclose that as partially verified.
- `make check` on the current `next` head.
**Prose:** the policy was just rewritten sentence by sentence. New sentences keep that bar: short, one idea each, lists as bullets, no coined terms. https://git.eeqj.de/sneak/prompts/pulls/147 already merged, so this rewrites that text directly.
Close this issue with the landing commit, title ending ` (closes #146)`.
Model: opus-5-5
clawbot
self-assigned this 2026-11-04 05:37:54 +01:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Found in review of #145. sneak's answer on #72 (comment) trusts the distribution's own package index and says PyPI, npm and
go getneed hashes. Canonical files atnextstill fetch these without a hash of ours:script/bootstrapinstalls yarn from npm by version (corepack prepare yarn@<version>, lines 133, 139 and 141).prompts/REPO_POLICIES.mdcalls this pinned.script/bootstrapinstalls node withnvm installby version (line 125).script/bootstraptakes base tools from nix and brew on a host. Neither is a distribution package index.testphase: pip downloads build tools without a hash check when a package has no wheel.prompts/REPO_POLICIES.mdstates this as a known gap.Definition of done
script/bootstrapin this repository stays byte-identical.Model: opus-5-5
Whenever and wherever possible, node and yarn and npm and python and the Python installer tools that are bundled with it should be installed from the distribution. And we don't need to worry about hashes. We trust the distribution and its packet ma package manager. All of the other third party stuff like Python packages, Go modules, node packages, etc., all need to be version pinned by hash, but the actual runtimetimes themselves are okay to be installed from the distribution. If they're too far out of date, then we need to use a newer distribution.
Implementer's brief for sneak's ruling at #146 (comment). One PR, base
next. It supersedes the definition of done above where they differ.The rule, stated once and agreed everywhere
npm install -g yarngo.prompts/REPO_POLICIES.md: one rule, no second exception beside it. A package source aDockerfileadds itself still does not count.script/bootstrap(edits by hand; stays one file, no new scripts)NODE_VERSION,NVM_VERSION,NVM_SHA256,YARN_VERSION,verify_sha256,nvm_sh,ensure_nvm,node_is_pinned_majorand the corepack and npm paths.pkg_install nodejs nodejs node nodejs. yarn: when bothyarnandyarnpkgare missing,pkg_install yarn yarnpkg yarn yarn. There is no version to compare, so a presence test is enough.yarnpkg, notyarn.script/bootstrap,script/fmtandscript/fmt-checkeach carry the same small function that runs whichever is present.script/fmtandscript/fmt-checklose their nvm path andNODE_VERSION.--frozen-lockfileor--immutableit refuses a yarn 1yarn.lock, and without them it rewrites the file and drops the hashes. Alpine has yarn 1.22.22 and no yarn 4, and Ubuntu 24.04 (the CI runner image) has 1.22.19. Soscript/bootstrapstops with a one-line message when yarn's major version is not 1, before installing anything, and leaves the tree clean. Yarn 4 on Debian may write.yarnrc.ymlwhen run; check that the version test does not. Keepyarn install --frozen-lockfile.This repository's
Dockerfilenode. Right afterFROM, aboveARG CACHEBUST,RUN apk add --no-cache git make nodejs yarn, so check builds keep that layer, the way the policy already places system packages. Correct the header comment that saysARG CACHEBUSTcomes first. Keep the version and date comment above eachFROM.Example Dockerfiles in
prompts/REPO_POLICIES.mddebian:trixie-slim, notpython, and installspython3 python3-pip python3-venvwithmakeandgitaboveARG CACHEBUST. It uses--no-install-recommends, so it needsca-certificatestoo, or every download fails on TLS (I hit this). Debian's python refuses a system-widepip install, so pipenv goes into a virtual environment the example creates. pipenv is not bundled with python, so it stays installed by hash. Build this example on a scratch repository and make it pass before writing it down. Fix every sentence around it that says the image's hash pins Python.PIP_ONLY_BINARY=:all:for the install, so a package with no wheel for the image stops the install instead. State this in the policy and disclose it as a judgement call. Check that it reaches pip when run through pipenv.golangandgolangci-lintstay pinned by digest. Disclose in one line.Everywhere else
REPO_POLICIES.md,prompts/REPO_POLICIES.md) stay byte-identical. Both checklists agree.last_modifiedand a new top entry inTODO.md's Completed Steps; older entries are history, so leave them.curl | bashsentence that names pyenv and nvm (rustup stays as the example); thescript/bootstrapparagraph; "Never install latest or lts; always exact versions" (true now only of tools outside the distribution); "The bootstrap alone is not enough" (bootstrap now leaves node and yarn onPATH, so this paragraph goes, butscript/cibuildstill bootstraps first); "Node is the exception to the whole-token comparison".nvm,corepack,pinned node,pinned yarn,pinned major,NODE_VERSION,node 22andpython@and leave nothing that disagrees,TODO.mdhistory aside. Do not touchscript/lintorscript/test, whose comments are #141.Must work, tried in fresh containers, each with
--rm(keep results off the tracker)docker.gitea.com/runner-images:ubuntu-latest, with the docker socket:git cloneinside the container, so no root-owned files land in your temp directory, thenscript/cibuild. It must pass with no yarn onPATHat the start.script/bootstrap,script/fmt-check.debian:trixie-slimandubuntu:26.04:script/bootstrapstops with the message, tree clean.make checkon the currentnexthead.Prose: the policy was just rewritten sentence by sentence. New sentences keep that bar: short, one idea each, lists as bullets, no coined terms. #147 already merged, so this rewrites that text directly.
Close this issue with the landing commit, title ending
(closes #146).Model: opus-5-5
Built in #148.
Model: opus-5-5