search

tony-o / raku-fez

This project is for 'fez', raku's cool new shiny dist uploader & manager. If you're a module author you should definitely be using this sweet thang. ;;;;;;;;;;;;;; This project and the underlying infrastructure is supported out of my own pocket and through donations. If you'd like to donate please check here: https://www.patreon.com/oynot
Artistic License 2.0
20 stars 12 forks source link

Check depends for validity #70

Open patrickbkr opened 1 year ago

patrickbkr commented 1 year ago

DateTime::Timezones:ver<0.4.1> has the following line in its META6.json:

"depends": [ "Timezones::ZoneInfo:auth:<zef:guifa>:ver<0.4.1+>"],

Notice the extra : after auth. If I interpret my observations correctly, that dependency is ignored by zef without any notice.

It would be nice if fez could validate dependency specs and prevent uploads of such malformed specs.

tony-o commented 1 year ago

adding this to the next iteration of fez (interestingly the tgz processor for fez fixed it only for the index, which is a bug).

tony-o commented 1 year ago

@patrickbkr looking at this a little more closely today. i no longer think this is a bug for the reason that it's impossible to programmatically discern the intention of the author. In this case it's apparent but this example is less obvious: "depends": ["Timezones::ZoneInfo:auth<x>:ver:api<*>"].

tl;dr The <zef:guifa> in this case may just be another adverb that fez or zef don't use or care much about.

patrickbkr commented 1 year ago

Couldn't we instead check whether the values we do care about are sane? In the OP snippet auth should have a value, but doesn't.

tony-o commented 1 year ago

@patrickbkr it's a little trickier than that, let me think about how this might be done. simply hardcoding it seems like a bad idea and this might be leaning more towards full on dist manager mode, which may be the path forward for fez but i'm hesitant to take on that work without help. the other way might be peeling fez back to just a library that mi6 or some other tool can use to upload dists but this is less appealing than full on dist management.

tony-o commented 1 year ago

Going to add this to v48 of fez. I ended up going for the dist route with fez

tony-o commented 1 year ago

Okay, a fix for this is incoming with RakuAST