zmuxuny opened a new issue, #5018:
URL: https://github.com/apache/rocketmq-dashboard/issues/5018

   ### Bug
   
   On current `rocketmq-studio` (`0228dad5`), a clean frontend build reaches 
the license gate and fails:
   
   ```
   cd web && npm ci && npm run build
   license gate: build artifact verification failed: assets/index-*.js
   ```
   
   The same failure occurs inside `docker build ./web`, so the frontend Docker 
CI job cannot pass even after the workflow startup problem in #4136 is fixed. 
The failure reproduces without any application code changes.
   
   ### Cause
   
   `distributionLicenses.generateBundle` hashes each chunk's `item.code` and 
emits `legal/manifest.json` before the final files are written. The entry chunk 
is subsequently changed by the build pipeline: its SHA-256 in 
`dist/assets/index-*.js` differs from the value in `manifest.outputFiles`, 
while every other output file matches. `checkDistribution` correctly rejects 
that mismatch, but the manifest recorded an intermediate chunk rather than the 
distributed bytes.
   
   ### Expected behavior
   
   The manifest records checksums of the files actually written to `dist/`. The 
existing post-build tamper check must continue to reject any later modification.
   
   ### Verification plan
   
   Add a fixture where a later build hook changes a chunk and verify the 
written distribution passes the license gate; then modify the emitted file and 
verify the gate fails. Run `npm run license:test`, `npm run build`, and the 
frontend Docker build.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to