Follow-ups to the version-stamp convention (sneak/project-management#21), found while rolling it out. Each is small; none blocks the rollout.
For the canonical text on next:
A build context sent as a tar stream keeps the sender's file owners, and git in the build then refuses the checkout ("detected dubious ownership"), so the version step fails. upaas clones as root and is unaffected; other build hosts are not. Recommendation: git config --system --add safe.directory /src in the example's builder stage (webhooker, mfer and currentstat.us already have it).
The styleguide's VERSION ?= $(shell git describe --tags --always) stamps an empty version outside a git checkout. Recommendation: $(or $(shell git describe --tags --always),dev), so every repo falls back to dev the same way.
Only the top-level .git/config is excluded; a submodule's .git/modules/*/config is not.
The example's test stage runs go test -race on the alpine Go image, where -race cannot work (it needs cgo).
make check prints the yarn warning "package.json: No license field".
Waits on the owner: the example installs git with an unpinned RUN apk add --no-cache git, while prompts/REPO_POLICIES.md says every external reference is pinned by hash, no exceptions (the existing apk add vips-dev example has the same gap). Options: (a) allow distribution packages from the pinned base image's own repository unpinned, and say so in the policy; (b) pin package versions (git=2.x.y-rN), which breaks whenever the base image moves; (c) use a base image that already ships git (the Debian Go images do). Recommendation: (a), since the base image itself is pinned by digest.
Model: opus-5-5
Follow-ups to the version-stamp convention (https://git.eeqj.de/sneak/project-management/issues/21), found while rolling it out. Each is small; none blocks the rollout.
For the canonical text on `next`:
1. A build context sent as a tar stream keeps the sender's file owners, and git in the build then refuses the checkout ("detected dubious ownership"), so the version step fails. upaas clones as root and is unaffected; other build hosts are not. Recommendation: `git config --system --add safe.directory /src` in the example's builder stage (webhooker, mfer and currentstat.us already have it).
2. The styleguide's `VERSION ?= $(shell git describe --tags --always)` stamps an empty version outside a git checkout. Recommendation: `$(or $(shell git describe --tags --always),dev)`, so every repo falls back to `dev` the same way.
3. Only the top-level `.git/config` is excluded; a submodule's `.git/modules/*/config` is not.
4. The example's test stage runs `go test -race` on the alpine Go image, where `-race` cannot work (it needs cgo).
5. `make check` prints the yarn warning "package.json: No license field".
Waits on the owner: the example installs `git` with an unpinned `RUN apk add --no-cache git`, while `prompts/REPO_POLICIES.md` says every external reference is pinned by hash, no exceptions (the existing `apk add vips-dev` example has the same gap). Options: (a) allow distribution packages from the pinned base image's own repository unpinned, and say so in the policy; (b) pin package versions (`git=2.x.y-rN`), which breaks whenever the base image moves; (c) use a base image that already ships `git` (the Debian Go images do). Recommendation: (a), since the base image itself is pinned by digest.
Model: opus-5-5
sneak
was assigned by clawbot2026-10-02 14:09:06 +02:00
Items 1-5 are being done as their own units: 1 and 4 in #73, 2 in #74, 3 in #75, 5 in #76. Only the pinning question above stays here for you; none of those units changes the apk add line.
Model: opus-5-5
Items 1-5 are being done as their own units: 1 and 4 in https://git.eeqj.de/sneak/prompts/issues/73, 2 in https://git.eeqj.de/sneak/prompts/issues/74, 3 in https://git.eeqj.de/sneak/prompts/issues/75, 5 in https://git.eeqj.de/sneak/prompts/issues/76. Only the pinning question above stays here for you; none of those units changes the `apk add` line.
Model: opus-5-5
a. the base image package index can be trusted too so an index pull is permissible. we trust the distro. we don’t trust package repos like dockerhub or pypi or npm or go get, so all those need hashes.
a. the base image package index can be trusted too so an index pull is permissible. we trust the distro. we don’t trust package repos like dockerhub or pypi or npm or go get, so all those need hashes.
Taken, per sneak's answer at #72 (comment) (option a). Implementer's brief:
The rule. The first rule of prompts/REPO_POLICIES.md keeps pinning by hash as the rule and gains his one exception. A package from the pinned base image's own distribution package index (apt-get install, apk add, and the index pull apt-get update) needs no version and no hash, because the distribution is trusted. Docker Hub, PyPI, npm and go get are not trusted, so everything from them stays pinned by hash. "No exceptions" and "zero exceptions" go, since they are no longer true.
What it does not cover. A package source a Dockerfile adds itself is not the distribution's own, so it does not get the exception. Say so in one sentence.
The example. The canonical Go Dockerfile's RUN apk add --no-cache git gets a short comment saying why it is allowed. The two Debian examples (libvips-dev; make and git) need no comment if the rule is clear; add one only if a reader would otherwise think they break it.
Everywhere else.grep both checklists, prompts/CODE_STYLEGUIDE.md and README.md for the pin rule, and make them agree.
script/bootstrap also takes base tools from nix and brew on a host. That is outside his answer: leave it unchanged and add one disclosure line to the PR.
last_modified and TODO.md as usual. No other rule changes.
Model: opus-5-5
Taken, per sneak's answer at https://git.eeqj.de/sneak/prompts/issues/72#issuecomment-165196 (option a). Implementer's brief:
- **The rule.** The first rule of `prompts/REPO_POLICIES.md` keeps pinning by hash as the rule and gains his one exception. A package from the pinned base image's own distribution package index (`apt-get install`, `apk add`, and the index pull `apt-get update`) needs no version and no hash, because the distribution is trusted. Docker Hub, PyPI, npm and `go get` are not trusted, so everything from them stays pinned by hash. "No exceptions" and "zero exceptions" go, since they are no longer true.
- **What it does not cover.** A package source a `Dockerfile` adds itself is not the distribution's own, so it does not get the exception. Say so in one sentence.
- **The example.** The canonical Go `Dockerfile`'s `RUN apk add --no-cache git` gets a short comment saying why it is allowed. The two Debian examples (`libvips-dev`; `make` and `git`) need no comment if the rule is clear; add one only if a reader would otherwise think they break it.
- **Everywhere else.** `grep` both checklists, `prompts/CODE_STYLEGUIDE.md` and `README.md` for the pin rule, and make them agree.
- `script/bootstrap` also takes base tools from nix and brew on a host. That is outside his answer: leave it unchanged and add one disclosure line to the PR.
- `last_modified` and `TODO.md` as usual. No other rule changes.
Model: opus-5-5
sneak
was unassigned by clawbot2026-11-03 23:09:16 +01:00
clawbot
self-assigned this 2026-11-03 23:09:16 +01:00
Built in #145: the first rule of prompts/REPO_POLICIES.md now allows packages from the pinned base image's own distribution package index with no version and no hash, and both checklists agree.
Model: opus-5-5
Built in https://git.eeqj.de/sneak/prompts/pulls/145: the first rule of `prompts/REPO_POLICIES.md` now allows packages from the pinned base image's own distribution package index with no version and no hash, and both checklists agree.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Follow-ups to the version-stamp convention (sneak/project-management#21), found while rolling it out. Each is small; none blocks the rollout.
For the canonical text on
next:git config --system --add safe.directory /srcin the example's builder stage (webhooker, mfer and currentstat.us already have it).VERSION ?= $(shell git describe --tags --always)stamps an empty version outside a git checkout. Recommendation:$(or $(shell git describe --tags --always),dev), so every repo falls back todevthe same way..git/configis excluded; a submodule's.git/modules/*/configis not.go test -raceon the alpine Go image, where-racecannot work (it needs cgo).make checkprints the yarn warning "package.json: No license field".Waits on the owner: the example installs
gitwith an unpinnedRUN apk add --no-cache git, whileprompts/REPO_POLICIES.mdsays every external reference is pinned by hash, no exceptions (the existingapk add vips-devexample has the same gap). Options: (a) allow distribution packages from the pinned base image's own repository unpinned, and say so in the policy; (b) pin package versions (git=2.x.y-rN), which breaks whenever the base image moves; (c) use a base image that already shipsgit(the Debian Go images do). Recommendation: (a), since the base image itself is pinned by digest.Model: opus-5-5
Items 1-5 are being done as their own units: 1 and 4 in #73, 2 in #74, 3 in #75, 5 in #76. Only the pinning question above stays here for you; none of those units changes the
apk addline.Model: opus-5-5
a. the base image package index can be trusted too so an index pull is permissible. we trust the distro. we don’t trust package repos like dockerhub or pypi or npm or go get, so all those need hashes.
Taken, per sneak's answer at #72 (comment) (option a). Implementer's brief:
prompts/REPO_POLICIES.mdkeeps pinning by hash as the rule and gains his one exception. A package from the pinned base image's own distribution package index (apt-get install,apk add, and the index pullapt-get update) needs no version and no hash, because the distribution is trusted. Docker Hub, PyPI, npm andgo getare not trusted, so everything from them stays pinned by hash. "No exceptions" and "zero exceptions" go, since they are no longer true.Dockerfileadds itself is not the distribution's own, so it does not get the exception. Say so in one sentence.Dockerfile'sRUN apk add --no-cache gitgets a short comment saying why it is allowed. The two Debian examples (libvips-dev;makeandgit) need no comment if the rule is clear; add one only if a reader would otherwise think they break it.grepboth checklists,prompts/CODE_STYLEGUIDE.mdandREADME.mdfor the pin rule, and make them agree.script/bootstrapalso takes base tools from nix and brew on a host. That is outside his answer: leave it unchanged and add one disclosure line to the PR.last_modifiedandTODO.mdas usual. No other rule changes.Model: opus-5-5
Built in #145: the first rule of
prompts/REPO_POLICIES.mdnow allows packages from the pinned base image's own distribution package index with no version and no hash, and both checklists agree.Model: opus-5-5