Conversation
✅ Deploy Preview for viteplus-preview canceled.
|
|
@codex review |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3c8979569f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@kazupon can you update install.ps1 too? |
|
@fengmk2 If you're referring to the Codex path-spoofing finding, it was specific to install.sh, whose AWK parser previously flattened JSON paths into dot-joined strings. install.ps1 uses nested property access ($Metadata.dist.attestations.provenance.predicateType), so a dotted top-level key cannot satisfy the check. I also added the dotted-top-level-key regression case to both installer test suites, and the PowerShell case rejects it. Please let me know if you had a different PowerShell concern in mind 🙏 |
…ackage-provenance # Conflicts: # .github/workflows/test-standalone-install.yml
…ackage-provenance # Conflicts: # crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/shim_package_manager_first_use/snapshots/non_interactive_use_defaults_to_managed_without_deciding.md
|
@kazupon Thanks, I will verify it once, and if there are no issues, I will merge it. |
|
@kazupon I think we should wait for #2611 finish, the install flow will have a big refactor after that. cc @liangmiQwQ |
|
@fengmk2 no problem! |
…venance' into issue-1826-platform-package-provenance
|
@fengmk2 |
|
@codex review |
fengmk2
added
test: e2e
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Codex Review: Didn't find any major issues. Keep them coming! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
fengmk2
added
the
preview-build
fengmk2
changed the title
Registry bridge build (
|
| Package | Version |
|---|---|
vite-plus |
0.0.0-commit.85644fb20281e9210840bf413e7dc377ad65fcd4 |
@voidzero-dev/vite-plus-core |
0.0.0-commit.85644fb20281e9210840bf413e7dc377ad65fcd4 |
Install the Vite+ CLI built from this commit, then migrate a project:
# macOS / Linux
curl -fsSL https://raw.githubusercontent.com/kazupon/vite-plus/85644fb20281e9210840bf413e7dc377ad65fcd4/packages/cli/install.sh | VP_PR_VERSION=2440 VP_LEGACY_INSTALLER_URL=https://raw.githubusercontent.com/kazupon/vite-plus/85644fb20281e9210840bf413e7dc377ad65fcd4/packages/cli/install-legacy.sh bash# Windows (PowerShell)
$env:VP_PR_VERSION="2440"; $env:VP_LEGACY_INSTALLER_URL="https://raw.githubusercontent.com/kazupon/vite-plus/85644fb20281e9210840bf413e7dc377ad65fcd4/packages/cli/install-legacy.ps1"; irm https://raw.githubusercontent.com/kazupon/vite-plus/85644fb20281e9210840bf413e7dc377ad65fcd4/packages/cli/install.ps1 | iexOr download the standalone Windows installer built from this commit:
| Architecture | Installer |
|---|---|
| x64 | vp-setup-x86_64-pc-windows-msvc.exe |
| Arm64 | vp-setup-aarch64-pc-windows-msvc.exe |
GitHub requires you to sign in and downloads each installer as a ZIP artifact. Extract vp-setup.exe, then run it against this preview build:
.\vp-setup.exe --version "0.0.0-commit.85644fb20281e9210840bf413e7dc377ad65fcd4" --registry "https://registry-bridge.viteplus.dev/"After installing, upgrade the current project's vite-plus to this test build with:
vp migrateOr point your package manager at the bridge registry https://registry-bridge.viteplus.dev/:
| Package manager | Registry config |
|---|---|
| npm / pnpm / Bun | .npmrc: registry=https://registry-bridge.viteplus.dev/ |
| Yarn (v2+) | .yarnrc.yml: npmRegistryServer: "https://registry-bridge.viteplus.dev/" |
Then pin the build (vite aliases to vite-plus-core; pnpm can use a catalog, npm an overrides entry):
{
"devDependencies": {
"vite-plus": "0.0.0-commit.85644fb20281e9210840bf413e7dc377ad65fcd4",
"vite": "npm:@voidzero-dev/vite-plus-core@0.0.0-commit.85644fb20281e9210840bf413e7dc377ad65fcd4"
}
}
|
The standalone Windows preview installation command fails, because our bridge registry don't includes provenance field. We need to adapt to this issue. .\vp-setup.exe --version "0.0.0-commit.85644fb20281e9210840bf413e7dc377ad65fcd4" --registry "https://registry-bridge.viteplus.dev/" |
3 participants
Summary
Closes #1826.
Vite+ previously accepted platform package metadata without requiring npm provenance, allowing an unverified release binary to reach the download path.
Require supported SLSA provenance before downloading standard release binaries through the standalone installers,
vp upgrade, andvp-setup.exe.Changes
dist.attestations.provenance.predicateTypeagainst SLSA v1 and v0.2 in the shared Rust resolver.Testing
cargo test -p vp_setup registry: provenance parsing, error classification, and download ordering.just check,just test,just lint: workspace compilation, tests, and Clippy.