loom/externals
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

confidentiality does not travel with the copy

Browse Source 
loom saw it while arranging access to a private cluster repository: then you would
have a file from a private repo in your repository, and that does not sound
kosher. It is not, and it is a hazard this convention creates by construction.

Adopting is copying, so a document from a repository somebody may not read ends up
in one they may, and the publisher loses control at the moment of adoption because
visibility is governed by the consumer's repository rather than theirs. Nothing in
a tree marks a copy as having come from somewhere private — a credential lets you
read and does not let you redistribute, and this convention had no way to say so.

Two ways out. Reference-only: record the lock, fetch on demand, keep no copy,
giving up offline reading which is most of what a copy is for. Or ask them to
publish, which is usually right because the thing you needed was almost certainly
not the confidential part — a repository that must stay private can have a public
sibling that publishes, and the split follows a line that already exists, since
the operational tree is what is sensitive and the pages telling somebody what to
decide are not.

Recorded as a rule rather than a case because the failure is silent and one-way:
once copied into a public tree it is published, and no later fix retrieves it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
jeffry
2026-09-07 15:09:47 -04:00
co-authored by Claude Opus 5
parent aff2065297
commit 544f895920
2 changed files with 53 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.loom/published/externals.md
+22
View File
@@ -24,6 +24,28 @@ in the document.*
you fetch may refer to others; follow one when you hit something you do not know.
**Pre-resolving that is how you get a `node_modules`.***
### Confidentiality does not travel with the copy
**Adopting is copying.** *So a document from a repository somebody may not read
ends up in a repository they may* — **and the publisher loses control of it at the
moment of adoption**, because the copy's visibility is governed by your repository
and not by theirs.
> **Do not adopt from a source less readable than the repository you are adopting
> into.** *If you may read it and your readers may not, copying it publishes it.*
**Two ways out, and the second is better when it is available.**
**Reference-only** — *record the lock and fetch on demand, keep no copy.* **You
give up reading it offline**, which is most of what a copy is for, *and you keep
the dependency recorded and checkable.*
**Ask them to publish** — *the thing you needed was almost certainly not the
confidential part.* **A repository that must stay private can still have a public
sibling that publishes**, and the split is usually along a line that already
exists: **the operational tree is what is sensitive; the pages telling somebody
what to decide are not.**
## Two facets beside it
- **`.usages.md`** — *what we use, and **which of our artifacts depend on it***