Consider digest pinning for more build stability #67

New Issue

decentral1se · 2021-06-03T09:15:04Z

decentral1se commented

2021-06-03 09:15:04 +00:00

We could be doing something like this in the compose.yml files: node:14.15.1@sha256:d938c1761e3afbae9242848ffbb95b9cc1cb0a24d889f8bd955204d347a7266e where you pin directly to a digest that you expect. This would stop whacky stuff happening later on if upstream decides to cheekily overwrite the tag.

We could be doing something like this in the `compose.yml` files: `node:14.15.1@sha256:d938c1761e3afbae9242848ffbb95b9cc1cb0a24d889f8bd955204d347a7266e` where you pin directly to a digest that you expect. This would stop whacky stuff happening later on if upstream decides to cheekily overwrite the tag.

👀 1

decentral1se added the

enhancement

label 2021-06-03 09:15:18 +00:00

3wordchant commented

2021-06-13 12:35:57 +00:00

Down for this.

Do we know what exactly would happen if we did this, in those situations "if upstream decides to cheekily overwrite the tag"?

Would the deploy just fail (and would we want to / be able to show a more helpful error than Docker?), or will it still grab the old tagged image from Docker Hub?

Down for this. Do we know what exactly would happen if we did this, in those situations "if upstream decides to cheekily overwrite the tag"? Would the deploy just fail (and would we want to / be able to show a more helpful error than Docker?), or will it still grab the old tagged image from Docker Hub?

decentral1se commented

2021-06-14 14:56:50 +00:00

I think it would just error out with "I can't find that tag with that hash" and then yeah, as you say, I think we'd need to provide some explanation after that. We could of coures have a --force logic here to override. This seems a bit tricky to manage to set up, we'd probably have to publish our own test image and then overwrite it? For now, we could just do the pinning and figure out the rest later.

I think it would just error out with "I can't find that tag with that hash" and then yeah, as you say, I think we'd need to provide some explanation after that. We could of coures have a `--force` logic here to override. This seems a bit tricky to manage to set up, we'd probably have to publish our own test image and then overwrite it? For now, we could just do the pinning and figure out the rest later.

This repo is archived. You cannot comment on issues.