Netlify and Hugo Pipes

[regis]

I just created this thread to funnel several channels’ discussions on the topic here.

FYI: Pending resolution of this Netlify issue it seems you have to commit your resources/ directory.

Any other questions concerns or welcomed tips, this is be the place to get attention

[bep]

@regis

it seems you have to commit your resources/ directory.

I see the above sentence as “something painful”. I would say that the above would be a perfectly fine workflow for many, and I think currently the only secure workflow if you want to use SRI.

Also, in a normal Hugo site, you would:

1. Design your pretty site.
2. Spend the next year writing content for your site.

One could argue that rebuilding your unchanged assets on every little comma change inside /content is wasteful, and it also adds to the stuff you need to test/verify before you publish. This is, of course, even more true for theme – where the design should be considered something stable that you get for free.

[regis]

@bep

I see the above sentence as “something painful”.

more like something I want to have the liberty to do or not do.

@bep

Spend the next year writing content for your site.

Well… I see some potential to let editors customize their theme/project’s assets using Hugo Pipes. So in this workflow, there’s no way to know when the assets will have to be rebuilt. Same goes with Page Bundle image processing.

I understand committing your resources/ is the right choice for many workflows, but is it for all? Honest question, I’m fairly uneducated on the subject.

@bep

think currently the only secure workflow if you want to use SRI

Now that’s interesting. Why is that so if I may ask?

[bep]

@regis

but is it for all? Honest

Surely not. But I see everyone talking about it as a workaround.

@regis

Now that’s interesting. Why is that so if I may ask?

With SRI you tell people that “the code you now is about to run has not been tampered with.” It protects against Man-in-the-middle attack - Wikipedia

And to do that, you will probably want to calculate the hashes in a place there are known to be very few men in the middle. On some cloud server or in your office where you can do manual checks that the hash sum matches the content? And if you commit these stable /resources to GitHub you get Git’s sha256 as an additional layer: You can look at the SRI hash and know for sure that this is the v1.0.0 of your JS library. And knowing that it hasn’t changed also has some other nice side-effects: It limits the test-scope on releases.

[TotallyInformation]

You might want this response here as well:

Are asset pipelines working on Netlify for anyone?

For clarity to help others, here is the full process. Install the extended version of Hugo locally. Make sure you have resources and assets folders, create them if needed. Make sure both folders are added to your git commit. Move resources you wish process into the assets folder. I created sub-folders in the same structure as the static folder that previously contained my css & js assets. Adjust your templates to use the resources function. See below for some examples. Run either hugo or hugo …

[regis]

@TotallyInformation

You might want this response here as well

I guess I didn’t use the right search query before posting this thead

Thanks @TotallyInformation

[regis]

@bep thanks for clarifying on the SRI stuff!

[junedev]

Netlify fixed the problem. For new projects that people set up on Netlify, this is not an issue anymore.

For existing projects you manually need to set Netlify to use a newer Ubuntu version. Here is the article that explains how to do it. No worries, it is not difficult. https://www.netlify.com/blog/2019/03/14/a-more-flexible-build-architecture-with-updated-linux/
After that you can safely include the resources/_gen folder in your .gitignore file (and remove them from git tracking).