feat(install): verify bun platform tarball against dist.integrity - #2301
feat(install): verify bun platform tarball against dist.integrity#2301jong-kyung wants to merge 1 commit into
Conversation
Apply the same registry integrity verification the pnpm 12 native flow uses to bun's @oven/bun-* platform tarball. The metadata fetch is extracted into a shared fetch_platform_integrity helper used by both flows; registries that omit dist.integrity keep the previous unverified behavior.
✅ Deploy Preview for viteplus-preview canceled.
|
|
@codex review |
|
Codex Review: Didn't find any major issues. Breezy! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 9ab65d01fb
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Closing this — #2140 moved |
## Summary Re-does #2301 on top of the pm-cli consolidation (#2140), which moved `vite_install/src/package_manager.rs` into `crates/vite_pm_cli` and made the old branch unrebaseable. - The `packageManager` hash names the main `bun` npm package, so the platform tarball (`@oven/bun-{os}-{arch}`) was downloaded without any verification. - Extracts the registry `dist.integrity` lookup that the pnpm >= 12 native path already implements inline into a shared `fetch_platform_integrity` helper, and applies it to the bun platform tarball as well. - The pnpm >= 12 path now uses the same helper, so its behavior is unchanged. Supersedes #2301. Co-authored-by: MK (fengmk2) <fengmk2@gmail.com>
1 participant
Summary
Bun platform downloads can now detect tarball corruption or mismatches before extraction by using the platform package's registry-provided
dist.integrity. The shared metadata lookup keeps integrity verification and version-not-found handling consistent with the pnpm 12 native download flow.Related: #2289