Closed certik closed 5 months ago
Let's not run fpm
at all, in our first deliverable of the registry.
Instead, let's add several checks in the Python backend, implemented in Python itself:
fpm.toml
as TOML into PythonAll the above checks must be just couple hundred lines of Python the most. If it requires more, then let's discuss. That way it will be maintainable for us.
Bonus:
Compare the package model of an uploaded package against the model in the registry to ensure no malicious code was added. Also for module naming conventions.
Details:
fpm
builds a local package into a source tarball, and exports the model to JSON. It packages the JSON file with the source tarball.fpm
uploads the source tarball with the JSON to registryfpm.toml
from the uploaded source tarballThis check is not for security, but rather for consistency of the uploaded packages, it checks:
fpm.toml
and all source files are consistent)A separate feature to consider for a separate milestone is:
fpm build
, that is, building the package using a Fortran compiler. This is effectively a CI. That's a huge milestone on its own.