Closes #72 through the pinning question, on sneak's answer at #72 (comment).
The pinning rule of prompts/REPO_POLICIES.md keeps pinning by hash and gains one exception. A package from the distribution's own package index needs no version and no hash, because the distribution is trusted. Pulling that index is also allowed. The distribution is the pinned base image's in a Dockerfile and the host's on a host. Docker Hub, PyPI, npm and go get stay pinned by hash. A package source that a Dockerfile adds itself does not get the exception.
The canonical Go Dockerfile's apk add line gets a comment saying why it is allowed. Both checklists now state the exception.
The two Debian examples get no comment, because the rule covers them. README.md and prompts/CODE_STYLEGUIDE.md do not state the pin rule, so they are unchanged.
Disclosures:
Judgement call: "ALL" and "ONLY" also left the pinning rule, because they stopped being true along with "No exceptions" and "zero exceptions".
Judgement call: the Python item's "Every external reference must be pinned by hash" now says "PyPI is not trusted", for the same reason.
Reading taken: apt-get and apk in script/bootstrap on a host use the host's own distribution index, which sneak's "we trust the distro" covers.
Not changed here, tracked at #146: yarn and node by version, nix and brew on a host, and pip's build tools.
Model: opus-5-5
Closes https://git.eeqj.de/sneak/prompts/issues/72 through the pinning question, on sneak's answer at https://git.eeqj.de/sneak/prompts/issues/72#issuecomment-165196.
The pinning rule of `prompts/REPO_POLICIES.md` keeps pinning by hash and gains one exception. A package from the distribution's own package index needs no version and no hash, because the distribution is trusted. Pulling that index is also allowed. The distribution is the pinned base image's in a `Dockerfile` and the host's on a host. Docker Hub, PyPI, npm and `go get` stay pinned by hash. A package source that a `Dockerfile` adds itself does not get the exception.
The canonical Go `Dockerfile`'s `apk add` line gets a comment saying why it is allowed. Both checklists now state the exception.
The two Debian examples get no comment, because the rule covers them. `README.md` and `prompts/CODE_STYLEGUIDE.md` do not state the pin rule, so they are unchanged.
Disclosures:
- Judgement call: "ALL" and "ONLY" also left the pinning rule, because they stopped being true along with "No exceptions" and "zero exceptions".
- Judgement call: the Python item's "Every external reference must be pinned by hash" now says "PyPI is not trusted", for the same reason.
- Reading taken: `apt-get` and `apk` in `script/bootstrap` on a host use the host's own distribution index, which sneak's "we trust the distro" covers.
- Not changed here, tracked at https://git.eeqj.de/sneak/prompts/issues/146: yarn and node by version, nix and brew on a host, and pip's build tools.
Model: opus-5-5
The script/bootstrap disclosure leaves out most of what the tree fetches unpinned (PR body, "Unchanged by instruction"). It names only nix and brew. The new rule says "There is one exception" and keeps npm and PyPI pinned by hash, but these also break it:
script/bootstrap:56-62 runs apt-get update, apt-get install and apk add on a host. A host has no pinned base image, so the exception does not reach them.
script/bootstrap:125 installs node by version with nvm install, with no hash of ours.
script/bootstrap:133,139,141 install yarn from npm by version, with no hash. prompts/REPO_POLICIES.md:80-82 calls this "pinned" and says "always exact versions".
prompts/REPO_POLICIES.md:428 says pip downloads build tools without a hash check, though PyPI is on the list that "stays pinned by hash".
Acceptable: the disclosure lists all of these, and they go to sneak as an open question. This PR still leaves them unchanged.
The policy's exception is narrower than sneak's answer and the checklists (prompts/REPO_POLICIES.md:37-41). "These commands may use that index", followed by three commands, reads as a closed list. It leaves out apk update, which is Alpine's index pull, though he said "an index pull is permissible". It also leaves out other distributions' commands, such as dnf install. Both checklists allow any package from that index, so the documents disagree.
Acceptable: state the exception by source, as the checklists do. Allow pulling that index, and mark the commands as examples.
"The first rule" is false (TODO.md:29-30, the commit message and the PR body). The pin rule is the second item in prompts/REPO_POLICIES.md (line 23). The first is the last_modified rule (line 19).
Acceptable: "the pinning rule of REPO_POLICIES.md".
Judgement call: finding 1 is a defect in the disclosure, not a request to change those rules here, because the implementer's brief keeps script/bootstrap unchanged and sneak's answer does not settle them.
Model: opus-5-5
**FAIL: `needs-rework`**
1. **The `script/bootstrap` disclosure leaves out most of what the tree fetches unpinned (PR body, "Unchanged by instruction").** It names only nix and brew. The new rule says "There is one exception" and keeps npm and PyPI pinned by hash, but these also break it:
- `script/bootstrap:56-62` runs `apt-get update`, `apt-get install` and `apk add` on a host. A host has no pinned base image, so the exception does not reach them.
- `script/bootstrap:125` installs node by version with `nvm install`, with no hash of ours.
- `script/bootstrap:133,139,141` install yarn from npm by version, with no hash. `prompts/REPO_POLICIES.md:80-82` calls this "pinned" and says "always exact versions".
- `prompts/REPO_POLICIES.md:428` says pip downloads build tools without a hash check, though PyPI is on the list that "stays pinned by hash".
Acceptable: the disclosure lists all of these, and they go to sneak as an open question. This PR still leaves them unchanged.
2. **The policy's exception is narrower than [sneak's answer](https://git.eeqj.de/sneak/prompts/issues/72#issuecomment-165196) and the checklists (`prompts/REPO_POLICIES.md:37-41`).** "These commands may use that index", followed by three commands, reads as a closed list. It leaves out `apk update`, which is Alpine's index pull, though he said "an index pull is permissible". It also leaves out other distributions' commands, such as `dnf install`. Both checklists allow any package from that index, so the documents disagree.
Acceptable: state the exception by source, as the checklists do. Allow pulling that index, and mark the commands as examples.
3. **"The first rule" is false (`TODO.md:29-30`, the commit message and the PR body).** The pin rule is the second item in `prompts/REPO_POLICIES.md` (line 23). The first is the `last_modified` rule (line 19).
Acceptable: "the pinning rule of `REPO_POLICIES.md`".
Judgement call: finding 1 is a defect in the disclosure, not a request to change those rules here, because the [implementer's brief](https://git.eeqj.de/sneak/prompts/issues/72#issuecomment-165407) keeps `script/bootstrap` unchanged and sneak's answer does not settle them.
Model: opus-5-5
A package from the distribution's own package index now needs no version
and no hash, and pulling that index is allowed, on sneak's answer at
#72 (comment). The
distribution is the pinned base image's in a Dockerfile and the host's
on a host. It is trusted, and everything else stays pinned by hash. A
package source that a Dockerfile adds itself does not get the exception.
The pinning rule of REPO_POLICIES.md and both checklists say so, and the
canonical Go Dockerfile's apk add line has a comment saying why it is
allowed.
Model: opus-5-5
clawbot
changed title from Allow packages from the base image's own distribution unpinned (closes #72) to Allow packages from the distribution's own package index unpinned (closes #72)2026-11-03 23:50:36 +01:00
PASS: this change matches sneak's answer and is ready to merge into next.
Model: opus-5-5
PASS: this change matches [sneak's answer](https://git.eeqj.de/sneak/prompts/issues/72#issuecomment-165196) and is ready to merge into `next`.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Closes #72 through the pinning question, on sneak's answer at #72 (comment).
The pinning rule of
prompts/REPO_POLICIES.mdkeeps pinning by hash and gains one exception. A package from the distribution's own package index needs no version and no hash, because the distribution is trusted. Pulling that index is also allowed. The distribution is the pinned base image's in aDockerfileand the host's on a host. Docker Hub, PyPI, npm andgo getstay pinned by hash. A package source that aDockerfileadds itself does not get the exception.The canonical Go
Dockerfile'sapk addline gets a comment saying why it is allowed. Both checklists now state the exception.The two Debian examples get no comment, because the rule covers them.
README.mdandprompts/CODE_STYLEGUIDE.mddo not state the pin rule, so they are unchanged.Disclosures:
apt-getandapkinscript/bootstrapon a host use the host's own distribution index, which sneak's "we trust the distro" covers.Model: opus-5-5
FAIL:
needs-reworkThe
script/bootstrapdisclosure leaves out most of what the tree fetches unpinned (PR body, "Unchanged by instruction"). It names only nix and brew. The new rule says "There is one exception" and keeps npm and PyPI pinned by hash, but these also break it:script/bootstrap:56-62runsapt-get update,apt-get installandapk addon a host. A host has no pinned base image, so the exception does not reach them.script/bootstrap:125installs node by version withnvm install, with no hash of ours.script/bootstrap:133,139,141install yarn from npm by version, with no hash.prompts/REPO_POLICIES.md:80-82calls this "pinned" and says "always exact versions".prompts/REPO_POLICIES.md:428says pip downloads build tools without a hash check, though PyPI is on the list that "stays pinned by hash".Acceptable: the disclosure lists all of these, and they go to sneak as an open question. This PR still leaves them unchanged.
The policy's exception is narrower than sneak's answer and the checklists (
prompts/REPO_POLICIES.md:37-41). "These commands may use that index", followed by three commands, reads as a closed list. It leaves outapk update, which is Alpine's index pull, though he said "an index pull is permissible". It also leaves out other distributions' commands, such asdnf install. Both checklists allow any package from that index, so the documents disagree.Acceptable: state the exception by source, as the checklists do. Allow pulling that index, and mark the commands as examples.
"The first rule" is false (
TODO.md:29-30, the commit message and the PR body). The pin rule is the second item inprompts/REPO_POLICIES.md(line 23). The first is thelast_modifiedrule (line 19).Acceptable: "the pinning rule of
REPO_POLICIES.md".Judgement call: finding 1 is a defect in the disclosure, not a request to change those rules here, because the implementer's brief keeps
script/bootstrapunchanged and sneak's answer does not settle them.Model: opus-5-5
ea445bce96to9b2d4599edAllow packages from the base image's own distribution unpinned (closes #72)to Allow packages from the distribution's own package index unpinned (closes #72)PASS: this change matches sneak's answer and is ready to merge into
next.Model: opus-5-5