The new plugin system allows to specify plugin versions using: (implicit) latest, by version and by SHA.
In the last case (by SHA), it is currently not possible to get the required SHA value directly from the Flux CLI. The PR that introduced pinning by SHA fetches these value from the GitHub release. This works, but is not obvious to users who are not familiar with the internal workings of the plugin system.
I would argue that one can place similar levels of trust in the Flux CLI and the GitHub API. This would allow us to fetch and display the SHA for a given version directly in the Flux CLI during flux plugin search.
I would propose to make two changes:
- Add a new flag
--digests to plugin search which displays the SHA in addition to the version. Similar to what docker image ls does
- Add high level documentation to https://fluxcd.io/flux/cli-plugins/ which explains the trade-off between the different version references and the intended use-cases and workflows.
If you agree with these changes I am happy to take a stab at a PR for this!
The new plugin system allows to specify plugin versions using: (implicit) latest, by version and by SHA.
In the last case (by SHA), it is currently not possible to get the required SHA value directly from the Flux CLI. The PR that introduced pinning by SHA fetches these value from the GitHub release. This works, but is not obvious to users who are not familiar with the internal workings of the plugin system.
I would argue that one can place similar levels of trust in the Flux CLI and the GitHub API. This would allow us to fetch and display the SHA for a given version directly in the Flux CLI during
flux plugin search.I would propose to make two changes:
--digeststoplugin searchwhich displays the SHA in addition to the version. Similar to what docker image ls doesIf you agree with these changes I am happy to take a stab at a PR for this!