Consider pinned repos when locking packages

Signed-off-by: Jon Johnson <[email protected]>
chainguard-dev · Jan 7, 2025 · 7ae4943 · 7ae4943
1 parent ed51f76
commit 7ae4943
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/pkg/build/lock.go b/pkg/build/lock.go
@@ -137,6 +137,10 @@ func unify(originals []string, inputs []resolved) (map[string][]string, map[stri
 		if idx := strings.IndexAny(orig, "=<>~"); idx >= 0 {
 			name = orig[:idx]
 		}
+		// If we're using a pinned repo (foo@local), strip that as well.
+		if idx := strings.Index(orig, "@"); idx >= 0 {
+			name = orig[:idx]
+		}
 		originalPackages.packages.Insert(name)
 		originalPackages.versions[name] = strings.TrimPrefix(orig, name)
 	}