jpkg: move default registry from GitHub Pages to SourceHut
ober
0b50526119b6c677540026610f388425a1a768fc
--- a/docs/jpkg-guide.md +++ b/docs/jpkg-guide.md @@ -103,10 +103,12 @@ jpkg verify --reproduce # prints the deterministic artifact digest ### Installing from the public @lisp registry The multicall binary ships with a built-in default registry pointing at -the public @lisp TUF mirror on GitHub Pages. On first use, jpkg syncs -the registry metadata into `$JERBOA_PKG_HOME/registries/lisp/` so the -full TUF verification chain (root → targets → release.json) runs over -local files; package blobs (.jpkg) are fetched on demand during install. +the public @lisp TUF registry on SourceHut +(`git.sr.ht/~lisp/jerboa-registry`). Files are served via the +`/blob/main/<path>` endpoint. On first use, jpkg syncs the registry +metadata into `$JERBOA_PKG_HOME/registries/lisp/` so the full TUF +verification chain (root → targets → release.json) runs over local +files; package blobs (.jpkg) are fetched on demand during install. ```sh mkdir app && cd app --- a/lib/std/pkg/registry.ss +++ b/lib/std/pkg/registry.ss @@ -83,17 +83,29 @@ ;; ── default registry (the canonical @lisp mirror) ────────────────────── ;; ;; The multicall ships with a built-in default registry pointing at the - ;; public @lisp TUF mirror on GitHub Pages. The mirror is just a static - ;; directory tree (metadata/, packages/, blobs/, etc.) served over HTTPS. - ;; On first use we sync metadata + publishers + transparency + all - ;; release.json files into a local cache under $JERBOA_PKG_HOME/registries/lisp/ - ;; so the existing TUF/registry code reads everything locally. Blobs - ;; (large .jpkg files) are fetched on demand from the mirror during install. + ;; public @lisp TUF registry on SourceHut (~lisp/jerboa-registry). The + ;; files are served via the /blob/main/<path> URL pattern — this is the + ;; raw-file endpoint that go-away's anti-bot proxy permits for anonymous + ;; clients (the /refs/download/ endpoint used by release artifacts is + ;; blocked by go-away for scripted clients). On first use we sync metadata + ;; + publishers + transparency + all release.json files into a local cache + ;; under $JERBOA_PKG_HOME/registries/lisp/ so the existing TUF/registry + ;; code reads everything locally. Blobs (large .jpkg files) are fetched + ;; on demand from the mirror during install. (def default-registry-name "lisp") + (def default-registry-repo + (or (getenv "JPKG_DEFAULT_REGISTRY_REPO") + "~lisp/jerboa-registry")) + (def default-registry-ref + (or (getenv "JPKG_DEFAULT_REGISTRY_REF") + "main")) (def default-registry-mirror + ;; Base URL for raw file access via the /blob/ endpoint. (or (getenv "JPKG_DEFAULT_REGISTRY_MIRROR") - "https://ober.github.io/jerboa-registry/")) + (string-append "https://git.sr.ht/" + default-registry-repo + "/blob/" default-registry-ref "/"))) (def (default-registry-local-path) (path-concat (jpkg-home*) (path-concat "registries" default-registry-name))) @@ -470,15 +482,16 @@ (let ([src (registry-blob-path reg-path digest)]) (unless (file-exists? src) ;; If this is the default registry, try fetching the blob from the - ;; mirror. The reg-path will match default-registry-local-path. + ;; mirror via the /blob/ endpoint. The reg-path will match + ;; default-registry-local-path. (let ([local-default (default-registry-local-path)]) (unless (and (string=? reg-path local-default) (begin (mkdir-p (path-concat local-default "blobs/sha256")) (http-fetch! (string-append - (string-trim-slash default-registry-mirror) - "/blobs/sha256/" digest) + default-registry-mirror + "blobs/sha256/" digest) src))) (jpkg-error "registry: blob ~a not found" digest)))) (let ([bv (read-file-bytevector src)])