novox/mesh-catalog
9
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

CAT-BN3: mesh-build-node publishes through the registry seats and holds no registry credential

Browse Source 
Bundles go through oci-artifact-registry and answer the seat's reference;
a trunk package is packed under the builder's version and published through
npm-package-registry, so the holder can check it with the builder. Reads are
anonymous, so the write pair, the sealed secret and the store's address go.
The one-part sender moves into buildstep for both build modules, so the move
to the registry clients is made in one place.

Claude-Session: https://claude.ai/code/session_01JG73KJNrH5EgFXMKKYSrig
This commit is contained in:
jschoubben
2026-11-04 15:30:06 +01:00
parent 39a8d8d7ee
commit af280050d6
21 changed files with 410 additions and 380 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/mesh-build-node/cmd/mesh-build-node/fetch_test.go
+4 -7
View File
@@ -192,7 +192,7 @@ func TestAnotherNovoxPackageIsInstalledFromTheRegistryThroughAUserconfig(t *test
files["modules/m/package-lock.json"] = `{}`
m, f := fetchMachine(t, files, map[string]string{"@novox/other/index.js": "o", "lodash/index.js": "l"})
m.Toolchain.Registry = func() (Registry, error) {
return Registry{URL: "https://git.novox.be/api/packages/novox/npm/", Username: "mesh-build-node", Password: "s3cret-pw!"}, nil
return Registry{URL: "https://git.novox.be/api/packages/novox/npm/"}, nil
}
var npmrc string
inner := f.effect
@@ -209,20 +209,17 @@ func TestAnotherNovoxPackageIsInstalledFromTheRegistryThroughAUserconfig(t *test
if err != nil {
t.Fatal(err)
}
if !strings.Contains(npmrc, "@novox:registry=https://git.novox.be/api/packages/novox/npm/") || !strings.Contains(npmrc, ":_auth=") {
// Reads are anonymous (ADR 0346, CAT-BN3): the config names the scope's registry and no credential.
if !strings.Contains(npmrc, "@novox:registry=https://git.novox.be/api/packages/novox/npm/") || strings.Contains(npmrc, "_auth") {
t.Errorf("npm ci was given the config %q", npmrc)
}
// The password holds characters a workspace's random name never does, so a name like "mvpwby…" is no false match.
if strings.Contains(strings.Join(npmCalls(f)[0].args, " "), "s3cret-pw!") {
t.Errorf("the credential is on npm's command line")
}
r := out.(FetchResult)
if _, err := os.Stat(filepath.Join(m.Work, r.Workspace, "tree", "modules", "m", "node_modules", "@novox", "other", "index.js")); err != nil {
t.Errorf("@novox/other was not installed: %v", err)
}
for _, e := range mustReadDir(t, filepath.Join(m.Work, r.Workspace)) {
if strings.HasPrefix(e, "npm-") {
t.Errorf("the scratch install (and its credential file) is left: %s", e)
t.Errorf("the scratch install is left: %s", e)
}
}
}