Repository navigation
Conversation
|
Important Draft PR not reviewedDraft PRs are not automatically reviewed by default.
To automatically review draft PRs, update your CodeRabbit configuration: reviews:
auto_review:
drafts: true
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. |
Member
Author
|
Updated in b1a25e1.
Written by an agent (Claude Code, claude-opus-5-5). |
Member
Author
|
Updated in 46fe43e: the survey now also covers the latest version of the 5,000 most-downloaded packages and a random older version of each of the top 2,000: 8,620 versions in total. 273 (about 3%) differ before normalization, and every one is explained by publisher-side normalization. The new rules: empty map versus absent field, Written by an agent (Claude Code, claude-opus-5-5). |
zkochan
added a commit
that referenced
this pull request
Oct 31, 2026
zkochan
added a commit
that referenced
this pull request
Oct 31, 2026
* rfc(pnpr): publish-time manifest verification Split from #44. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * rfc(pnpr): store profile upgrades beside accepted manifests Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * rfc(pnpr): normalize npm publish documents before manifest comparison npm publish uploads the output of @npmcli/package-json prepare(), not the raw package.json, so a strict comparison would reject ordinary uploads (bin refs, the gypfile install-script injection, bundleDependencies true, version cleaning). Define these as profile normalizations, accept the one benign direction (submitted claims a build the archive cannot run), add name and version to the compared fields, and add evidence from the npm trackers plus a 1,674-package survey of registry metadata vs archives. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * rfc: extend the manifest survey to the most-downloaded packages Add the latest version of the 5,000 most-downloaded packages and a random older version of each of the top 2,000. 273 of 8,620 versions differ before normalization; all are explained by publisher-side normalization, which adds empty-vs-absent maps, directories.bin expansion, stripped build metadata, and git shorthand expansion to the profile. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * rfc(pnpr): clarify lifecycle script comparison, engines normalization, and link #50 --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Registry metadata is the publishing client's normalized manifest while the archive keeps the raw package.json. A survey of the 1,674 registry packages in pnpm/pnpm's lockfile found 46 differences, all explained by bin syntax, optional dependencies copied into dependencies, the gypfile injection, and an added engines default. Without normalization the check would fail eslint, glob, and fsevents. Fail only when the archive declares more than the metadata. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Add the latest version of the 5,000 most-downloaded packages and a random older version of each of the top 2,000. 273 of 8,620 versions differ before normalization; all are explained by publisher-side normalization, which adds empty-vs-absent maps, directories.bin expansion, stripped build metadata, and git shorthand expansion to the profile. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ords Publish-time manifest verification and release records have merged. The links point at their files, and the motivation says what each covers: pnpr hosted packages, pnpr's archive-derived records for proxied packages, and this check for every other registry and as defense in depth for pnpr. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
zkochan
force-pushed
the
rfc/install-time-manifest-check
branch
from
November 1, 2026 23:36
46fe43e to
5c89aa7
Compare
14 of 39 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Before any dependency code runs, pnpm compares the install-critical fields in each package's
package.jsonwith the metadata that resolution used. A mismatch fails the install with the package and differing fields named. The check covers packages from any registry, including store hits and frozen installs.This complements publish-time manifest verification (#47) and release records (#49), both merged. They make a pnpr registry serve archive-derived metadata for the packages it hosts and proxies; this check covers every other registry, such as the public npm registry, and is defense in depth for pnpr. It establishes consistency between metadata and contents, not that either is trustworthy.
Updated by an agent (Claude Code, claude-opus-5-5).
🤖 Generated with Claude Code