5e714577fb
Some checks failed
Payment domain, storage, platform and UI / isolated-payment-tests (push) Has been cancelled
Payment domain, storage, platform and UI / payment-ui-tests (push) Has been cancelled
PDF engine / engine (push) Has been cancelled
PDF engine / makepad-integration (push) Has been cancelled
PDF engine / fuzz (push) Has been cancelled
repo hygiene / hygiene (push) Has been cancelled
nigig-build (CAD) / supply-chain (push) Has been cancelled
nigig-build (CAD) / cad-module (push) Has been cancelled
nigig-build (CAD) / full-crate-check (push) Has been cancelled
nigig-map / test (push) Has been cancelled
Upstream adopted the makepad fork fix (8fdff3f) but pinned it as
`rev = "a79f0dc"` -- a 7-character abbreviation. The pinning gate passed,
because it only checked that `rev = ` was present at all. Its own error
message has said "Add rev = \"<full-40-char-sha>\"" since it was written,
without ever enforcing it.
An abbreviated rev resolves only while no other object in the repository
shares its prefix. That is a property of the current object count, not a
guarantee -- it is why git's own auto-abbreviation length grows with a
repo. A short pin therefore degrades on its own over time, and someone
who can push to the fork can attempt to manufacture a colliding prefix.
For a dependency that executes at build time, that is a supply-chain
weakness rather than a style preference.
Checked before assuming: a79f0dc currently resolves uniquely in the fork
(exactly one matching object), so nothing is broken today. This closes it
while it is still cheap.
- All 34 manifests expanded to the full SHA
a79f0dce4d477e2232344facca0798d3f25043ec. Cargo.lock is unchanged by
the expansion, confirming it is the same commit and purely notational.
- The gate now also rejects any rev that is not exactly 40 hex chars.
Negative-tested: restoring the 7-char form makes it fire.
685 lib tests pass; all nine gates pass.
23 lines
1.1 KiB
TOML
23 lines
1.1 KiB
TOML
[package]
|
|
name = "spreadsheet-ui"
|
|
version = "0.1.0"
|
|
edition = "2021"
|
|
description = "Makepad widget wrappers for the spreadsheet engine."
|
|
|
|
[dependencies]
|
|
# TODO: Update this path to match how your other crates reference makepad.
|
|
# Options:
|
|
# 1. If makepad is a git dependency in your workspace:
|
|
# makepad-widgets = { git = "https://github.com/makepad/makepad.git", branch = "release" }
|
|
# 2. If makepad is a local path relative to the workspace root:
|
|
# makepad-widgets = { path = "../../../makepad/widgets" }
|
|
# 3. If makepad is referenced the same way as nigig-build:
|
|
# Copy the makepad-widgets dependency line from nigig-build's Cargo.toml
|
|
#
|
|
# For now, using a relative path from this crate's location:
|
|
# crates/apps/spreadsheet/spreadsheet-ui/ → ../../../../makepad/widgets
|
|
makepad-widgets = { git = "https://gitdab.com/andodeki/makepad", rev = "a79f0dce4d477e2232344facca0798d3f25043ec"}
|
|
spreadsheet-engine = { path = "../spreadsheet-engine" }
|
|
|
|
[dev-dependencies]
|
|
makepad-test = { git = "https://gitdab.com/andodeki/makepad", rev = "a79f0dce4d477e2232344facca0798d3f25043ec", package = "makepad-test" }
|