jpkg: use Forgejo ober registry by default
ober
bc15afcf4d67ff28319d4d5ba0ddd07d697e47cf
--- a/docs/jpkg-guide.md +++ b/docs/jpkg-guide.md @@ -103,27 +103,27 @@ jpkg verify me-demo-0.1.0.jpkg jpkg verify --reproduce # prints the deterministic artifact digest ``` -### Installing from the public @lisp registry +### Installing from the public @ober registry -The multicall binary ships with a built-in default registry pointing at -the public @lisp TUF registry on SourceHut -(`git.sr.ht/~lisp/jerboa-registry`). Files are served via the -`/blob/main/<path>` endpoint. On first use, jpkg syncs the registry -metadata into `$JERBOA_PKG_HOME/registries/lisp/` so the full TUF +The multicall binary ships with a built-in default registry pointing at the +public @ober TUF registry at +`https://git.jerboa.sh/ober/jerboa-registry`. Files are served through +Forgejo's `/raw/branch/main/<path>` endpoint. On first use, jpkg syncs the registry +metadata into `$JERBOA_PKG_HOME/registries/ober/` so the full TUF verification chain (root → targets → release.json) runs over local files; package blobs (.jpkg) are fetched on demand during install. ```sh mkdir app && cd app jpkg init @me/app -jpkg add jerboa-ssh # bare names auto-resolve to @lisp/jerboa-ssh +jpkg add jerboa-ssh # bare names auto-resolve to @ober/jerboa-ssh # write code that (import (jerboa-ssh api)) jerboa app.ss # just works — no env wrapper needed ``` Bare package names (without `@scope/`) are auto-prefixed with the -default scope `@lisp`. Override with `JPKG_DEFAULT_SCOPE=@other`, or -always use the explicit form `jpkg add @lisp/jerboa-ssh`. +default scope `@ober`. Override with `JPKG_DEFAULT_SCOPE=@other`, or +always use the explicit form `jpkg add @ober/jerboa-ssh`. Suppress the built-in default with `JPKG_NO_DEFAULT_REGISTRY=1` (e.g. to enforce that only your own registries are visible). --- a/lib/std/pkg/commands.ss +++ b/lib/std/pkg/commands.ss @@ -531,7 +531,7 @@ (say "package directories (~a):" (case src [(env) "from JERBOA_PKG_REGISTRIES"] - [(default) "from built-in default (sync from public @lisp mirror)"] + [(default) "from built-in default (sync from public @ober mirror)"] [else "from config file"])) (if (null? entries) (say " (none configured)") --- a/lib/std/pkg/registry.ss +++ b/lib/std/pkg/registry.ss @@ -80,32 +80,29 @@ (let ([home (or (getenv "HOME") (jpkg-error "registry: HOME not set"))]) (path-concat home ".jerboa/pkg")))) - ;; ── default registry (the canonical @lisp mirror) ────────────────────── + ;; ── default registry (the canonical @ober mirror) ────────────────────── ;; ;; The multicall ships with a built-in default registry pointing at the - ;; public @lisp TUF registry on SourceHut (~lisp/jerboa-registry). The - ;; files are served via the /blob/main/<path> URL pattern — this is the - ;; raw-file endpoint that go-away's anti-bot proxy permits for anonymous - ;; clients (the /refs/download/ endpoint used by release artifacts is - ;; blocked by go-away for scripted clients). On first use we sync metadata - ;; + publishers + transparency + all release.json files into a local cache - ;; under $JERBOA_PKG_HOME/registries/lisp/ so the existing TUF/registry - ;; code reads everything locally. Blobs (large .jpkg files) are fetched - ;; on demand from the mirror during install. - - (def default-registry-name "lisp") + ;; public @ober TUF registry on Forgejo (ober/jerboa-registry). Files are + ;; served through Forgejo's /raw/branch/<ref>/<path> endpoint. On first use + ;; we sync metadata + publishers + transparency + all release.json files + ;; into a local cache under $JERBOA_PKG_HOME/registries/ober/ so the + ;; existing TUF/registry code reads everything locally. Blobs (large .jpkg + ;; files) are fetched on demand from the mirror during install. + + (def default-registry-name "ober") (def default-registry-repo (or (getenv "JPKG_DEFAULT_REGISTRY_REPO") - "~lisp/jerboa-registry")) + "ober/jerboa-registry")) (def default-registry-ref (or (getenv "JPKG_DEFAULT_REGISTRY_REF") "main")) (def default-registry-mirror - ;; Base URL for raw file access via the /blob/ endpoint. + ;; Base URL for raw file access via Forgejo's raw branch endpoint. (or (getenv "JPKG_DEFAULT_REGISTRY_MIRROR") - (string-append "https://git.sr.ht/" + (string-append "https://git.jerboa.sh/" default-registry-repo - "/blob/" default-registry-ref "/"))) + "/raw/branch/" default-registry-ref "/"))) (def (default-registry-local-path) (path-concat (jpkg-home*) (path-concat "registries" default-registry-name))) @@ -188,7 +185,7 @@ (def (registry-config) ;; -> ((name . path) ...) in priority order. - ;; Built-in default: the @lisp registry at $JERBOA_PKG_HOME/registries/lisp/ + ;; Built-in default: the @ober registry at $JERBOA_PKG_HOME/registries/ober/ ;; (synced on first use from default-registry-mirror). Override with ;; JERBOA_PKG_REGISTRIES or the config file — if either is non-empty, ;; the default is suppressed (so power users can opt out by setting @@ -477,7 +474,7 @@ (def (registry-fetch-blob reg-path digest dest) ;; Copy blob to dest; verify digest BEFORE handing it over. - ;; For the default @lisp registry, blobs live on a public mirror and + ;; For the default @ober registry, blobs live on a public mirror and ;; are fetched on demand (the local cache only stores metadata). (let ([src (registry-blob-path reg-path digest)]) (unless (file-exists? src)