LYR-PKG0012

a dependency's build script the root does not trust

Reported when a dependency has a build.lyr and the root manifest's [trust] build-scripts does not name it. The build stops before any script runs, at the line that declares the dependency.

Explanation

A build script is a program that runs on the machine that builds. The root package's own script always runs; a dependency's runs only where the root says so, so adding a dependency never runs someone else's code unasked.

Read the dependency's script, and if it is acceptable, name the package in the root manifest: [trust] build-scripts = ["geo"].

Wrong

//- lyric.toml
[package]
name = "app"
version = "0.1.0"

[dependencies]
geo = { path = "libs/geo" }
//- libs/geo/lyric.toml
[package]
name = "geo"
version = "1.0.0"
//- libs/geo/build.lyr
fn main(): void {
}
//- libs/geo/src/lib.lyr
pub fn area(r: int): int {
    return 3 * r * r;
}
//- src/main.lyr
import geo { area };

fn main(): void {
    let _ = area(2);
}

Right

//- lyric.toml
[package]
name = "app"
version = "0.1.0"

[dependencies]
geo = { path = "libs/geo" }

[trust]
build-scripts = ["geo"]
//- libs/geo/lyric.toml
[package]
name = "geo"
version = "1.0.0"
//- libs/geo/build.lyr
fn main(): void {
}
//- libs/geo/src/lib.lyr
pub fn area(r: int): int {
    return 3 * r * r;
}
//- src/main.lyr
import geo { area };

fn main(): void {
    let _ = area(2);
}