Open flokli opened 2 years ago
Hey, have you come across any problem due to this?
jsonnet bundler(jb) does have a way to pin the dependencies. Look at https://github.com/prometheus-operator/kube-prometheus/blob/main/jsonnetfile.lock.json for example.
Hey, have you come across any problem due to this?
Yes, I can't build this project in a sandboxed environment without network access. If you'd either ship the dependencies vendored-in, or commit a lockfile with hashes, that should work.
It seems this project uses
jsonnet-builder
as a way to manage jsonnet dependencies.I peeked at the
jsonnetfile.json
in the repo:This just seems to use the master branch, but doesn't use any strong pinning.
This means, it's not possible to ensure the same outputs are produced, or building in a sandbox where network access is blocked (except for dependencies where the hash is already provided upfront).
Does jsonnet-builder provide some sort of lockfile, or could you use their vendoring function instead of loosely tracking master?