24 ms·
Hey! Yeah, we recommend using pnpm. Excellent tool. You might be interested in this feature from 1.2: "You can enable Turborepo to sign artifacts with a secret
by leerob 5y ago
Hey! Yeah, we recommend using pnpm. Excellent tool. You might be interested in this feature from 1.2:
"You can enable Turborepo to sign artifacts with a secret key before uploading them to the Remote Cache. Turborepo uses HMAC-SHA256 signatures on artifacts using a secret key you provide. Turborepo will verify the remote cache artifacts' integrity and authenticity when they're downloaded. Any artifacts that fail to verify will be ignored and treated as a cache miss by Turborepo"
https://turborepo.org/docs/features/remote-caching https://turborepo.org/docs/features/remote-caching
- forty 5y agoHMAC are symmetric signatures, which means that anyone who can check the signature can also poison the cache (so pushing only from the CI are reading/checking on the dev machines would not be possible)