F5 The plugin catalogue and what vouches for a plugin
- Area
- F — Extensibility
- Audience
- operator
- Kind
- feature
- Status
- accepted
- Maturity
- built
- Labels
- extensibility, security, verification
- Requires
- F3
The feature in the specification · Read at
Requirements
A reviewed plugin catalogue MUST exist as a git repository in the project's organisation, and every plugin MUST enter it by a pull request that passes the catalogue's checks, with signed commits, merged by a maintainer.
- F5-R2superseded
Superseded by F5-R13: a proof failing as declared does not refuse a contribution. The number is not reused.
- replaced by
- F5-R13
- locked by
- no version locks it yet
Catalogue releases MUST be signed, and a signature that does not verify MUST be refused.
An operator MUST be able to install a plugin from a git source or local path they name.
A plugin not installed from the catalogue MUST be installed as unreviewed, MUST be said so at install time, and MUST carry that for as long as it is installed.
Technical validation — schema, declared reach, proofs — MUST be identical for reviewed and unreviewed plugins.
Where a plugin came from, at which revision, and what signed it MUST be recorded at install and readable afterwards.
A plugin MUST declare every host its recipes reach, and reaching an undeclared host MUST be refused.
- locked by
- 0.17.0 met
- recorded done
- lemonfibercrates/lemonfiber-plugin/src/refusing/recipes.rs
- cited by
- lemonfiber@8d312584bf
The account of what leaves this machine MUST include hosts declared by installed plugins, and MUST attribute each to the plugin that declared it.
- locked by
- 0.17.0 met
- recorded done
- lemonfibercrates/lemonfiber-core/src/outbound/theirs.rs
- cited by
- lemonfiber@7070b3ea53
An unreachable catalogue MUST NOT affect installed plugins, and MUST NOT prevent installing from a named source.
A plugin whose origin can no longer be fetched MUST keep working and MUST be reported as unupdatable.
- locked by
- 0.17.0 met
- recorded done
- lemonfibercrates/lemonfiber-core/src/app/plugins/fetching.rs
- cited by
- lemonfiber@8254d2b85alemonfiber@8d312584bf
Two plugins of the same name from different origins MUST be refused, naming both origins.
The catalogue's CI MUST validate every manifest against the published schema and run every declared proof, and MUST refuse a contribution any of whose proofs is neither passed nor failing as declared (F10-R13). A proof failing as declared MUST be named as such and MUST NOT be counted as passed.
- locked by
- 0.17.0 met
- recorded done
- lemonfiber-pluginsregistry/check.py.github/reader/reader.py.github/reader/test_reader.py::test_failing_as_declared_is_never_counted_as_passed.github/reader/test_reader.py::test_a_failure_beside_one_failing_as_declared_fails_the_run
- cited by
- lemonfiber-plugins@dfe97e31c6
An install by name MUST resolve the name only through a catalogue index whose signature verified against the key lemonfiber carries, and MUST install the revision that index names.
An install by name MUST refuse a verified index whose serial is lower than the highest serial this machine has verified, and MUST resolve nothing through it.