Thore CimbalandClaude Opus 5
be323edf10
Nothing in this repo said where @sorb/threadnet-call-embedded comes from. It worked only because pnpm-lock.yaml carries the full tarball URL and CI installs with --frozen-lockfile; the first version bump drops that cover. Today that ends in a 404 because the name is still free on npmjs - which makes our only protection the fact that nobody has claimed @sorb there. Claim it and the same command resolves silently against a stranger's package, in the exact moment a fresh download looks normal. The checked-in .npmrc closes the wrong path instead of documenting it. It holds a URL and no secret: read access to the registry is anonymous. Upstream's .gitignore ignores /.npmrc - reasonable where the file holds tokens, and it would have swallowed this fix without a word. The negation is explicit and carries the reason, so the next merge does not quietly restore the hole. Verified in an isolated tree, not assumed: without the file pnpm resolves to npmjs and fails; with it the scope resolves to rohana at the same integrity hash the repo lockfile already carries; with rohana unreachable the install fails outright rather than falling back to npmjs. pnpm install --frozen-lockfile still passes and leaves the lockfile untouched. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
16 lines
841 B
Plaintext
16 lines
841 B
Plaintext
# Der Scope @sorb liegt in der Gitea-Registry auf rohana, nicht auf npmjs.
|
|
#
|
|
# Ohne diese Zeile loest pnpm @sorb/threadnet-call-embedded gegen
|
|
# registry.npmjs.org auf. Dass das bisher gutging, lag allein am Lockfile: es
|
|
# pinnt die vollstaendige Tarball-URL, und die CI installiert mit
|
|
# --frozen-lockfile. Beim ersten Anheben der Version faellt dieser Schutz weg.
|
|
#
|
|
# Heute endet das in einem 404, weil der Name auf npmjs frei ist. Genau darauf
|
|
# darf man sich nicht verlassen: registriert dort jemand @sorb, loest derselbe
|
|
# Befehl still gegen ein fremdes Paket auf (dependency confusion) - und zwar in
|
|
# dem Moment, in dem ein neuer Download ohnehin erwartet wird.
|
|
#
|
|
# Kein Geheimnis in dieser Datei: der Lesezugriff auf die Registry ist anonym.
|
|
# Siehe management#0055.
|
|
@sorb:registry=https://rohana.axion1337.de/api/packages/sorb/npm/
|