Repository navigation
Add --latest to mirror only the newest version - #631
Conversation
An unversioned PURL mirrors every version the upstream lists. With --latest, or "latest": true in a mirror API job, only the newest is mirrored: the highest by the ecosystem's version ordering, without yanked or retracted versions and, unless there is nothing else, pre-releases.
andrew
left a comment
andrew
left a comment
There was a problem hiding this comment.
newestVersion and RegistryVersions.LatestVersion define "latest" locally, but git-pkgs/registries v0.12.0 (already in go.mod) has a shared policy for this in registries.FetchLatestVersion(ctx, reg, name) / SelectLatestVersion. It prefers the version the registry advertises (npm dist-tags.latest, pub, deno, conda), then the newest active version by publish time, and excludes every non-empty status, including StatusDeprecated, which this PR keeps.
The two disagree in practice: an npm package with 4.0.0 published by mistake and deprecated, and dist-tags.latest at 3.4.0, gets 4.0.0 mirrored here while registries and npm itself say 3.4.0.
Please have RegistryVersions.LatestVersion call registries.FetchLatestVersion on the client from r.registry(...), pulling the helm/swift name rewriting out of fetchVersions so both paths share it. That removes newestVersion, the cmp import and the direct vers dependency. The tests should cover the advertised-version case. If the publish-time fallback turns out wrong for mirroring, that change belongs in registries rather than here.
# Conflicts: # internal/mirror/source.go
--latest now uses the shared policy from git-pkgs/registries: the version the registry advertises as latest where it has one, otherwise the newest active version by publish time. Deprecated versions are left out too, and newestVersion and the direct vers dependency go away.
|
Done in ea2baef. |
andrew
left a comment
andrew
left a comment
There was a problem hiding this comment.
The update addresses my earlier review by using registries.FetchLatestVersion and covering the advertised-version case.
proxy mirror pkg:npm/lodashmirrors every version the upstream lists. To keep the newest release of some packages cached, from cron for example, you have to look the version up first.--latest(or"latest": truein a mirror API job) mirrors only the newest version of unversioned PURLs: the highest by the ecosystem's ordering (git-pkgs/vers, now a direct dependency), skipping yanked and retracted versions, and pre-releases unless there is nothing else. Versioned PURLs, also in an SBOM, are mirrored as given. Cooldown isn't applied, as for the rest ofmirror.Tests cover the version ordering for npm, PyPI, gem, Go and Maven, the PURL and SBOM sources, the API request, and yanked versions with a fake crates.io.