Sovereign Tech Fund project: host fpm registry

[awvwgk]

Aim of this project is to develop a web server that will allow the uploading and downloading of packages. Packages will have names and version numbers, and be associated with one or more maintainers. Users must have an account and be logged in to upload packages. A package maintainer will be able to assign other maintainers and remove a package from the registry - either a specific version or the package in its entirety. Only a package maintainer will be allowed to upload new versions of an existing package.

T1: Initial Prototype of the web server

2 months (M1-M2)
The initial prototype will be capable of creating user accounts and allowing logged-in users to upload packages. It will allow package maintainers to remove a specific version of a package, or the package in its entirety. It will include sufficient tools for moderation and administration. I.e. administrators will be able to assign new maintainers to packages, delete user accounts, remove packages, etc. Finally, users will be able to download packages via a well-defined API without authentication.

T2: Upload Restrictions and Checks

2 months (M3-M4; requires T1)
One important check and restriction for a package on upload will be to ensure that all modules provided by a package are prefixed with the name of the package. This will ensure that module name conflicts do not arise between different packages. It is estimated that it will take 1 month to implement this check.
Another important aspect will be to ensure that the package can be built as a dependency.
As other checks and restrictions are determined, we will implement them as time allows.

T3: API for Query and Mirror

1 month (M5; requires T1)
To improve efficiency and reliability for users, we will implement an API allowing tools to easily query and mirror the repository. This will involve obtaining a list of all packages and versions, and bulk downloading of packages.

T4: fpm Support

1 month (M6)
Enable fpm to support uploading packages, querying the registry for available packages and versions, and fetching packages and their dependencies.

Deliverables

• D1: Prototype of a web server.
  • Period: M2.
  • Mean of verification: Web page available as frontend
• D2: Implementation of restrictions and checks.
  • Period: M4.
  • Mean of verification: See package violating checks fail to upload
• D3: API for query and mirror.
  • Period: M4.
  • Mean of verification: Access to API
• D4: Prototype version supporting fpm.
  • Period: M5:
  • Mean of verification: Use fpm to interact with the registry
• D5: Prototype supporting restrictions, checks, query and mirror, and fpm.
  • Period: M6.
  • Mean of verification: Use fpm and/or web frontend to interact with the registry. Implementation available on GitHub