Skip to content
jaseci-labsPublic

About

The public package index for Jac: index lines, org ownership and immutable package blobs

Resources

Stars

0 stars

Watchers

0 watching

Forks

Latest commit

 

History

3 Commits

Folders and files

NameName
Last commit message
Last commit date
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

jac-index

The public package index for Jac. jac install org/name resolves packages from this repository, and jac publish adds them to it.

Layout

config.json                  protocol version, blob store, this repository
orgs/<org>.toml              owners = ["github-login", ...]: who may publish org/*
index/<org>/<name>.json      one JSON object per line, one line per published version
reserved.txt                 org names nobody can claim

Every index line names a package version, its role (lib or template), its dependencies, the jac versions it supports, the digest of its exported API, and the sha256 of its .jab. Clients read index/<org>/<name>.json over HTTPS from raw.githubusercontent.com and download blobs from the blobs release of this repository, named <sha256>.jab, checking every hash.

Publishing

Run jac publish in the package's root. It builds the package, runs the publish gates (scoped name, a new semantic version, jac check, registry-only dependencies, a public source repository, and the semver check against the previous release's exported API), uploads the .jab as a release asset on your fork of this repository, and opens a pull request that appends one line to index/<org>/<name>.json.

This repository's CI re-runs the checks with jac publish --verify-index: the pull request may only append lines (or mark a line yanked), its author must own the org, the uploaded artifact must match the line's sha256 and manifest, and the exported API is rebuilt from the package source. A passing pull request has its artifact copied into the blobs release and is merged. Published versions never change and are never deleted.

Orgs

Claim an org by opening a pull request that adds orgs/<org>.toml listing yourself as an owner. Org claims are reviewed by a maintainer rather than merged automatically. Names in reserved.txt cannot be claimed.

Yanking

jac publish --yank <version> opens a pull request that sets "yanked": true on a line. New resolutions skip a yanked version; projects whose jac.lock already pins it keep working.

Private indexes

Any repository with this layout is a registry. Point a project at one with [registries] in jac.toml; see the Jac packages reference.

About

The public package index for Jac: index lines, org ownership and immutable package blobs

Resources

Stars

0 stars

Watchers

0 watching

Forks

Releases

Packages

Contributors