mirror of
https://github.com/pnpm/pnpm.git
synced 2026-07-21 05:02:30 -04:00
0876a0034b
Reviewer flagged that storeIndexKey(integrity, pkgId) collapses the
built/not-built dimension that gitHostedStoreIndexKey carries. Toggling
ignoreScripts between installs would let one variant overwrite the
other and a later install with the opposite setting would silently
read the wrong cached content.
Switch the design so git-hosted resolutions are addressed by
gitHostedStoreIndexKey(pkgId, { built }) consistently:
- Writer (getFilesIndexFilePath): detect git-hosted via tarball URL
prefix and skip the integrity-key fast path; fall through to
gitHostedStoreIndexKey regardless of whether integrity is present.
- Fetcher: drop the dual-write (no more storeIndexKey alias) and the
pkgId field on FetchOptions that only existed for it.
- Readers (pkg-finder, modules-mounter/daemon, building/after-install):
detect git-hosted via tarball URL and route to gitHostedStoreIndexKey.
The lockfile still pins integrity for security and the worker still
validates it on download — that part of the security fix is unchanged.
The FUSE TODO(v12) fallback that compensated for missing-integrity
lockfiles is gone — git-hosted is now keyed the same way regardless
of integrity, so there's no upgrade-only branch to clean up later.
---
Written by an agent (Claude Code, claude-opus-4-7).