|
|
|
@@ -1,6 +1,6 @@
|
|
|
|
|
---
|
|
|
|
|
title: Repository Policies
|
|
|
|
|
last_modified: 2026-10-21
|
|
|
|
|
last_modified: 2026-10-26
|
|
|
|
|
---
|
|
|
|
|
|
|
|
|
|
This document covers repository structure, tooling, and workflow standards. Code
|
|
|
|
@@ -395,14 +395,14 @@ style conventions are in separate documents:
|
|
|
|
|
the lockfile is out of date with `Pipfile`.
|
|
|
|
|
- A kept layer holds nothing a new install would refuse: pip checked pipenv
|
|
|
|
|
and its dependencies, and pipenv checked the lockfile's packages, against
|
|
|
|
|
their hashes. The packages `virtualenv` puts into the virtualenv that
|
|
|
|
|
pipenv creates come from wheels the `virtualenv` package ships, which its
|
|
|
|
|
hash covers. Two things in the layer are not fixed by a hash. A package
|
|
|
|
|
with no ready-built wheel for the image is built from source. pip
|
|
|
|
|
downloads the build tools without a hash check, so a kept layer's build of
|
|
|
|
|
such a package may differ from a new one. And system packages keep the
|
|
|
|
|
versions the package manager gave when the layer was built; a new install
|
|
|
|
|
may get newer ones.
|
|
|
|
|
their hashes. pipenv creates its virtual environment with the `virtualenv`
|
|
|
|
|
package. The packages that `virtualenv` adds come from wheels inside that
|
|
|
|
|
package, so the hash pip checked for it covers them. Two things in the
|
|
|
|
|
layer are not fixed by a hash. A package with no ready-built wheel for the
|
|
|
|
|
image is built from source. pip downloads the build tools without a hash
|
|
|
|
|
check, so a kept layer's build of such a package may differ from a new
|
|
|
|
|
one. And system packages keep the versions the package manager gave when
|
|
|
|
|
the layer was built; a new install may get newer ones.
|
|
|
|
|
- As with Go's modules, the packages are kept in a layer, not a cache mount.
|
|
|
|
|
A cache mount is shared by every build on the host, and nothing checks its
|
|
|
|
|
files again.
|
|
|
|
|