Enhancement: Support specifying package versions by digest

[zong-zhe]

Enhancement

Currently, KPM supports OCI Registry only through OCI Tag. In the future, KPM can continue to supports the OCI digest.

[Gmin2]

Hi @zong-zhe can i start working on the issue , and can you provide some more information around the issue, Thanks..

[zong-zhe]

Hi @Gmin2 😄

Welcome!

This part supports the extension of KCL OCI registry dependency. OCI registry supports the download of the KCL tripartite library from the OCI registry through two flags, Tag and digest. It is similar to Git repository, Just as you can download content via the branch name, tag, and commit flags, kpm currently only supports interaction with OCI registry via Tag. We need to extend the functionality of kpm to enable it to interact with OCI registry using digest.

The APIs in this package use Source as input.

Source is here:

kpm/pkg/downloader/source.go

Line 36 in 742130e

type Source struct {

You can first add a field called digest to the OCI in source.

Oci is here:

kpm/pkg/downloader/source.go

Line 51 in 742130e

type Oci struct {

Then step by step try to use this field in the logic inside kpm to download the KCL package in OCI Registry.

This function may involve a lot of changes; you can split this function into multiple PRs. The first step is to make kcl.mod and kcl.mod.lock. These two files support digest. Andf feel free to ask questions 😄

[7h3-3mp7y-m4n]

If the issue is stale then I would love to work on this, Thanks!