search

purescript / registry-dev

Development work related to the PureScript Registry
https://github.com/purescript/registry
97 stars 80 forks source link

Verify manifest against request and metadata #516

Closed thomashoneyman closed 1 year ago

thomashoneyman commented 2 years ago

This PR adds two verification checks we've long planned but never implemented:

  1. Make sure the manifest matches the package name submitted via the API (we try not to trust the API-provided information)
  2. Make sure the manifest matches the registry metadata for everything except the owners field. Transfers should happen via a Transfer operation, not by changing the manifest. This ensures transfers happen correctly as discussed in https://github.com/purescript/registry-dev/issues/331.
f-f commented 1 year ago

Did we just forget about this PR?

thomashoneyman commented 1 year ago

Yes, it just never got approved. I think it's still the correct thing to do.

f-f commented 1 year ago

Cool, let's get this through - does it make sense to rebase it now or best to wait until all the other things are settled?

thomashoneyman commented 1 year ago

@f-f Want to give this another look?