sneak/prompts
1
0
Fork 0
Code Issues 6 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

REPO_POLICIES: the pinning rule covers what we download and install ourselves; distribution packages are outside it #154

New Issue
Closed
opened 2026-11-06 01:10:03 +01:00 by clawbot · 1 comment
clawbot commented 2026-11-06 01:10:03 +01:00
Collaborator
Copy Link
Copy Source

sneak, 2026-11-06 in chat: "update the external reference rule in repo policies to clarify that this is for things we download and install ourselves in scripts and dockerfiles; distro package don't count, 'apt update && apt upgrade -y && apt install -y build-essential' is fine."

Today the rule in prompts/REPO_POLICIES.md opens "External references must be pinned by cryptographic hash … It covers everything fetched from a remote source". Distribution packages appear only later, as "one exception", so they read as an exception to a rule that covers them.

Definition of done. In prompts/REPO_POLICIES.md, on next:

  • The opening sentence states the scope. The rule is for what we download and install ourselves in scripts and Dockerfiles: base images, modules and packages from language registries (Go, PyPI, npm), GitHub Actions, and release archives fetched with curl or wget.
  • Distribution packages are outside the rule. Packages from the distribution's own package manager need no version and no hash. That is the image's distribution in a Dockerfile and the host's on a host, nix and brew included. Updating and upgrading are fine too: the policy gives apt update && apt upgrade -y && apt install -y build-essential as an example of something allowed. Say this right after the opening sentence, not as an exception at the end.
  • The rest stays as it is. The list of what gets pinned and how, the curl | bash ban, the untrusted sources, the rule that a package source a Dockerfile adds itself is not the distribution's own, and the Node and yarn guidance all keep their meaning. Only the order and wording change, to fit.
  • Any checklist in the repo that restates this rule says the same.
  • Plain short sentences; make fmt and make check pass.
  • One commit ending (closes #N), PR into next.

Model: opus-5-5

sneak, 2026-11-06 in chat: "update the external reference rule in repo policies to clarify that this is for things we download and install ourselves in scripts and dockerfiles; distro package don't count, 'apt update && apt upgrade -y && apt install -y build-essential' is fine." Today the rule in `prompts/REPO_POLICIES.md` opens "External references must be pinned by cryptographic hash … It covers everything fetched from a remote source". Distribution packages appear only later, as "one exception", so they read as an exception to a rule that covers them. **Definition of done.** In `prompts/REPO_POLICIES.md`, on `next`: - **The opening sentence states the scope.** The rule is for what we download and install ourselves in scripts and Dockerfiles: base images, modules and packages from language registries (Go, PyPI, npm), GitHub Actions, and release archives fetched with `curl` or `wget`. - **Distribution packages are outside the rule.** Packages from the distribution's own package manager need no version and no hash. That is the image's distribution in a Dockerfile and the host's on a host, nix and brew included. Updating and upgrading are fine too: the policy gives `apt update && apt upgrade -y && apt install -y build-essential` as an example of something allowed. Say this right after the opening sentence, not as an exception at the end. - **The rest stays as it is.** The list of what gets pinned and how, the `curl | bash` ban, the untrusted sources, the rule that a package source a Dockerfile adds itself is not the distribution's own, and the Node and yarn guidance all keep their meaning. Only the order and wording change, to fit. - Any checklist in the repo that restates this rule says the same. - Plain short sentences; `make fmt` and `make check` pass. - One commit ending `(closes #N)`, PR into `next`. Model: opus-5-5
clawbot commented 2026-11-06 01:11:58 +01:00
Author
Collaborator
Copy Link
Copy Source

Implemented in #156. The pinning rule now opens with its scope, and distribution packages follow right after as outside it. Both checklists say the same.

Model: opus-5-5

Implemented in https://git.eeqj.de/sneak/prompts/pulls/156. The pinning rule now opens with its scope, and distribution packages follow right after as outside it. Both checklists say the same. Model: opus-5-5
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
critical
Extremely important: data loss, a security hole, production down, or basic use impossible
 merge-ready
PR approved and ready to merge
 needs-checks
A check is red
 needs-rebase
PR conflicts with its base branch and must be rebased
 needs-review
PR needs code review
 needs-rework
PR needs changes based on review
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
clawbot sneak (Jeffrey Paul)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: sneak/prompts#154