summaryrefslogtreecommitdiff
path: root/docs/linking_to_external_code/integrity_checking.md
diff options
context:
space:
mode:
authorBartek IwaƄczuk <biwanczuk@gmail.com>2021-07-20 16:25:36 +0200
committerGitHub <noreply@github.com>2021-07-20 16:25:36 +0200
commitd744c0c6d9a557bbaa2a23571ffb3acabf19c35a (patch)
tree6f7fb8a71b786e79c48f4b2c11a5a9ca988717e8 /docs/linking_to_external_code/integrity_checking.md
parent9b9becf1ae256b645e37a7eecf3441f3ae4b8ea5 (diff)
chore: move docs to separate repository
Diffstat (limited to 'docs/linking_to_external_code/integrity_checking.md')
-rw-r--r--docs/linking_to_external_code/integrity_checking.md85
1 files changed, 0 insertions, 85 deletions
diff --git a/docs/linking_to_external_code/integrity_checking.md b/docs/linking_to_external_code/integrity_checking.md
deleted file mode 100644
index 3de2a5fca..000000000
--- a/docs/linking_to_external_code/integrity_checking.md
+++ /dev/null
@@ -1,85 +0,0 @@
-## Integrity checking & lock files
-
-### Introduction
-
-Let's say your module depends on remote module `https://some.url/a.ts`. When you
-compile your module for the first time `a.ts` is retrieved, compiled and cached.
-It will remain this way until you run your module on a new machine (say in
-production) or reload the cache (through `deno cache --reload` for example). But
-what happens if the content in the remote url `https://some.url/a.ts` is
-changed? This could lead to your production module running with different
-dependency code than your local module. Deno's solution to avoid this is to use
-integrity checking and lock files.
-
-### Caching and lock files
-
-Deno can store and check subresource integrity for modules using a small JSON
-file. Use the `--lock=lock.json` to enable and specify lock file checking. To
-update or create a lock use `--lock=lock.json --lock-write`. The
-`--lock=lock.json` tells Deno what the lock file to use is, while the
-`--lock-write` is used to output dependency hashes to the lock file
-(`--lock-write` must be used in conjunction with `--lock`).
-
-A `lock.json` might look like this, storing a hash of the file against the
-dependency:
-
-```json
-{
- "https://deno.land/std@$STD_VERSION/textproto/mod.ts": "3118d7a42c03c242c5a49c2ad91c8396110e14acca1324e7aaefd31a999b71a4",
- "https://deno.land/std@$STD_VERSION/io/util.ts": "ae133d310a0fdcf298cea7bc09a599c49acb616d34e148e263bcb02976f80dee",
- "https://deno.land/std@$STD_VERSION/async/delay.ts": "35957d585a6e3dd87706858fb1d6b551cb278271b03f52c5a2cb70e65e00c26a",
- ...
-}
-```
-
-A typical workflow will look like this:
-
-**src/deps.ts**
-
-```ts
-// Add a new dependency to "src/deps.ts", used somewhere else.
-export { xyz } from "https://unpkg.com/xyz-lib@v0.9.0/lib.ts";
-```
-
-Then:
-
-```shell
-# Create/update the lock file "lock.json".
-deno cache --lock=lock.json --lock-write src/deps.ts
-
-# Include it when committing to source control.
-git add -u lock.json
-git commit -m "feat: Add support for xyz using xyz-lib"
-git push
-```
-
-Collaborator on another machine -- in a freshly cloned project tree:
-
-```shell
-# Download the project's dependencies into the machine's cache, integrity
-# checking each resource.
-deno cache --reload --lock=lock.json src/deps.ts
-
-# Done! You can proceed safely.
-deno test --allow-read src
-```
-
-### Runtime verification
-
-Like caching above, you can also use the `--lock=lock.json` option during use of
-the `deno run` sub command, validating the integrity of any locked modules
-during the run. Remember that this only validates against dependencies
-previously added to the `lock.json` file. New dependencies will be cached but
-not validated.
-
-You can take this a step further as well by using the `--cached-only` flag to
-require that remote dependencies are already cached.
-
-```shell
-deno run --lock=lock.json --cached-only mod.ts
-```
-
-This will fail if there are any dependencies in the dependency tree for mod.ts
-which are not yet cached.
-
-<!-- TODO - Add detail on dynamic imports -->