[e-lang] Module naming and identification

[Bill Frantz]

lex at lexspoon.org (Lex Spoon) on Wednesday, April 15, 2009 wrote:

>Better, though, would be to scan  
>the code for module
>references and pick a specific version for each one.  Then, dump all  
>of these
>module references into a single JSON map going from module name to
>module version.  This JSON map could be included in the initial app  
>download,
>and it can be consulted as part of the implementation of require().

This approach is similar to the approach we used with Passport at
Communities.com.

We used the SHA1 hash of the file as the file name. When a browser started
to run Passport, the server sent out a signed "manifest", which contained
the secure hashes of all the components needed to run the application. If
one or more of them were not present on the client machine, they were
downloaded (from the server, but any file with the correct hash from
anywhere was acceptable).

Note that the code would only allow the application to run with a
particular version of a component. A more complex manifest format could
allow multiple versions, but our requirement was to only run with the most
current version.

Cheers - Bill

-------------------------------------------------------------------------
Bill Frantz        | The first thing you need when  | Periwinkle
(408)356-8506      | using a perimeter defense is a | 16345 Englewood Ave
www.pwpconsult.com | perimeter.                     | Los Gatos, CA 95032