Repository navigation
versions: fetch, a download in a directory only as the bytes it pins - #80
Merged
Merged
Conversation
aledbf
force-pushed
the
versions/fetch
branch
from
November 8, 2026 04:18
357568d to
fc65d71
Compare
`go tool versions fetch <name> <dir>` puts a download entry's file in dir, named as its URL names it, and prints the path (upstream.PinnedFile). A file already there is checked every time and kept when it is the pin; one that is not is downloaded again; a download that is not the pin is refused, written beside the file and never renamed into place, so nothing is left. Pinned is the same check held in memory; this one streams, for a store's tarball of 150 MB. spin wrote it twice in shell - hack/stores' fetch() and tools:shellcheck - as curl, `versions env`, sed and `sha256sum -c`. sha256Of is download into io.Discard now, one copy of the read-and-hash. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
aledbf
force-pushed
the
versions/fetch
branch
from
November 8, 2026 04:21
fc65d71 to
e2b6cbf
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
go tool versions fetch <name> <dir>puts a download entry's file in dir, named as its URL names it, and prints the path (upstream.PinnedFile)..partbeside the file and renamed only once it matches, so a refusal leaves nothing.Pinnedis the same check held in memory; this one streams, for a 150 MB tarball.sha256Ofis nowdownloadintoio.Discard, one copy of the read-and-hash.spin writes this twice in shell, in
hack/stores'fetch()and intools:shellcheck(curl,versions env, sed,sha256sum -c); a spin PR replaces both once this is tagged.Checked: tests for fresh, cached (no download), replaced, refused and refused-over-a-cached-file, and the command against a TLS server.
mutate -base origin/main: 37 refused, 0 survived. Against spin's versions.yaml: victoriametrics fetched, fetched again from the cache, and a corrupted cache replaced; the sha256 is the pin.Lint's vulngate is red on main for an unrelated advisory; #78 fixes it.
🤖 Generated with Claude Code