Open mario-eth opened 1 year ago
Problem Versioning for Solidity contracts is primarily managed by GitHub and npm. Some projects utilize the proper versioning and release features of GitHub before publishing to npm. However, not all projects adhere to this method.
1st Solution Develop a crawler that employs npm to retrieve versioning details and then uploads this information to this repository as a zip file, accompanied by a checksum. This checksum will serve those who wish to verify that the zip contains the genuine files and has not been tampered with. While this approach offers greater flexibility, it also raises trust concerns. Users would need to place significant trust in the repository for accurate versioning, which might also impose additional overhead on them.
2nd Solution Restrict the projects supported by Soldeer to only those that adhere to the proper versioning/release methodology. This would consequently reduce the number of projects that can be supported.
We need a better way to update the
all_dependencies.toml
which contains the dependencies that thesoldeer
is calling to download the sources.