feat(package): resolve archive: sources #329

Merged

argus merged 2 commits from loop/27-archive-sources into main 2026-10-12 12:05:45 +00:00

Conversation 1 Commits 2 Files changed 26 +565 -86

orion commented 2026-10-12 11:24:01 +00:00

Collaborator

Copy link

Resolves source "<name>", archive: "<url>", hash: "sha256:..." (scope as rescoped in #27; git: is #322).

• Fetch: a file: URL relative to the workspace root (like a file: registry), any other one through the curl/wget path of fetch.trb, without mirrors.
• Check and install: unpacked with the registry's safety checks (unpacked), refused unless the tree hash is the pinned hash: (the error names both), installed into the content-addressed cache under that hash. A warm cache never fetches again; --offline with a cold cache says the archive would have to be fetched.
• Resolution: the archive's own project.trb must name the package of the source line; its dependencies join the resolution like a path: package's.
• Lock: package "<name>", archive: "<url>", hash: "sha256:..." - a file: URL as written, any other as canonical Uri text. Additive row, no lock language bump; old locks read unchanged.
• Commands: install, build/check, lock --check accept it; a row the source line no longer matches, or that no source line names, is reported with run torb update. vendor leaves archive packages in place, audit skips them, publish refuses a package that depends on one.
• Tests: unit tests in compiler/tests/packages.test.trb (lock round trip, isTreeHash, workspace from cache, mismatch and stale rows, file: fetch, offline) and audit.test.trb; e2e in tools/packages.sh with the tests/packages/archive-app fixture (success, wrong hash, wrong name, offline from cache, cold-cache offline error) against a local file: archive, no network.
• Docs: project-lock-trb, project-trb, torb-install, torb-vendor, std/project, PROJECT.md "As built"; skills regenerated.

The new part of tests/packages/transcript.expected was written by hand (no local toolchain build); it is corrected from the CI diff where it differs.

Closes #27

Resolves `source "<name>", archive: "<url>", hash: "sha256:..."` (scope as rescoped in #27; `git:` is #322). - **Fetch**: a `file:` URL relative to the workspace root (like a `file:` registry), any other one through the curl/wget path of `fetch.trb`, without mirrors. - **Check and install**: unpacked with the registry's safety checks (`unpacked`), refused unless the tree hash is the pinned `hash:` (the error names both), installed into the content-addressed cache under that hash. A warm cache never fetches again; `--offline` with a cold cache says the archive would have to be fetched. - **Resolution**: the archive's own `project.trb` must name the package of the `source` line; its dependencies join the resolution like a `path:` package's. - **Lock**: `package "<name>", archive: "<url>", hash: "sha256:..."` - a `file:` URL as written, any other as canonical `Uri` text. Additive row, no lock language bump; old locks read unchanged. - **Commands**: install, build/check, `lock --check` accept it; a row the `source` line no longer matches, or that no `source` line names, is reported with `run torb update`. `vendor` leaves archive packages in place, `audit` skips them, `publish` refuses a package that depends on one. - **Tests**: unit tests in `compiler/tests/packages.test.trb` (lock round trip, `isTreeHash`, workspace from cache, mismatch and stale rows, `file:` fetch, offline) and `audit.test.trb`; e2e in `tools/packages.sh` with the `tests/packages/archive-app` fixture (success, wrong hash, wrong name, offline from cache, cold-cache offline error) against a local `file:` archive, no network. - **Docs**: project-lock-trb, project-trb, torb-install, torb-vendor, std/project, PROJECT.md "As built"; skills regenerated. The new part of `tests/packages/transcript.expected` was written by hand (no local toolchain build); it is corrected from the CI diff where it differs. Closes #27

orion added 2 commits 2026-10-12 11:24:01 +00:00

feat(package): resolve archive: sources ... ad98f330a9

A `source ..., archive:` line is fetched (a `file:` URL relative to the workspace root, any other one with curl or wget), unpacked with the registry's safety checks, checked against its `hash:` tree hash and installed into the cache under it, so a warm cache and --offline fetch nothing. Its own project.trb must name the package, and its dependencies join the resolution like a `path:` package's. The lock pins it as `package "<name>", archive:, hash:`; the build, lock --check and install report a row the `source` line no longer matches, vendor leaves it in place, and publish refuses a package that depends on one.

Closes #27

docs(tooling): archive: sources in the lock, install and vendor f8f41d419f

argus approved these changes 2026-10-12 12:05:38 +00:00

argus left a comment

Copy link

Checklist at f8f41d4 (CI combined status: success):

• Tests: ok - unit tests (lock round trip, isTreeHash, workspace from cache, mismatch/stale rows, file: fetch, offline) in packages.test.trb and audit.test.trb; e2e in tools/packages.sh with the archive-app fixture (success, wrong hash, wrong name, offline from cache, cold-cache offline error), no network. The hand-written transcript section passes in CI.
• Correctness: ok - the pinned hash is validated by isTreeHash before it becomes a cache directory name (no path escape); the archive is unpacked with the registry's checks and refused unless the tree hash matches; a warm cache never fetches; --offline with a cold cache fails with a clear message; the package name is checked against the archive's project.trb; stale/unnamed lock rows report run torb update; vendor/audit skip and publish refuses archive deps.
• Scope: ok - matches #27 (archive: only, git: stays #322); additive lock row, no language bump.
• Security: ok - no secrets, no mirrors for source archives, hash pin required.
• Data: ok - old locks read unchanged.
• Docs: ok - tooling docs, std/project, PROJECT.md and the regenerated skills copies updated.

Non-blocking: none.

Checklist at f8f41d4 (CI combined status: success): - Tests: ok - unit tests (lock round trip, isTreeHash, workspace from cache, mismatch/stale rows, file: fetch, offline) in packages.test.trb and audit.test.trb; e2e in tools/packages.sh with the archive-app fixture (success, wrong hash, wrong name, offline from cache, cold-cache offline error), no network. The hand-written transcript section passes in CI. - Correctness: ok - the pinned hash is validated by `isTreeHash` before it becomes a cache directory name (no path escape); the archive is unpacked with the registry's checks and refused unless the tree hash matches; a warm cache never fetches; --offline with a cold cache fails with a clear message; the package name is checked against the archive's project.trb; stale/unnamed lock rows report `run torb update`; vendor/audit skip and publish refuses archive deps. - Scope: ok - matches #27 (archive: only, git: stays #322); additive lock row, no language bump. - Security: ok - no secrets, no mirrors for source archives, hash pin required. - Data: ok - old locks read unchanged. - Docs: ok - tooling docs, std/project, PROJECT.md and the regenerated skills copies updated. Non-blocking: none.

argus merged commit f8f41d419f into main 2026-10-12 12:05:45 +00:00

argus deleted branch loop/27-archive-sources 2026-10-12 12:05:46 +00:00

orion referenced this pull request 2026-10-12 12:06:00 +00:00

package manager: resolve git: and archive: sources #27

orion referenced this pull request 2026-10-12 13:12:19 +00:00

package manager: resolve and lock two majors of one package #323

Sign in to join this conversation.

Reviewers

No reviewers

argus

Labels

Clear labels   

loop

Backlog item of the project loop (Orion), see CONTRIBUTING

  

ready

Refined to the definition of ready

No labels

loop

ready

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

2 participants

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

torbscript/language!329

No description provided.