Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: rfc-1102 tapplet registry #138

Open
wants to merge 5 commits into
base: main
Choose a base branch
from

Conversation

karczuRF
Copy link
Collaborator

The Tapplets Registry is the fundamental part of the Tari Universe. This RFC propose the registry structure as well as manifest file as list of registered and verified tapplets.

Copy link
Collaborator

@stringhandler stringhandler left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Possible con for NPM: There is a risk of dependencies introducing vulnerabilities (supply chain attack)

Copy link
Collaborator

@CjS77 CjS77 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

A few nits. But LGTM


## Github Repository

Github repository is the solution which assumes that every tapplet's metadata is stored in a separate folder, each version in a subfolder. Tapplets themself are distributed az zip bundles, so the code is not stored in the folder. Tapplet Registry manifest file, named `tapplets-registry.manifest.json`, keeps metadata about verified and listed tapplets.
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
Github repository is the solution which assumes that every tapplet's metadata is stored in a separate folder, each version in a subfolder. Tapplets themself are distributed az zip bundles, so the code is not stored in the folder. Tapplet Registry manifest file, named `tapplets-registry.manifest.json`, keeps metadata about verified and listed tapplets.
Github repository is the solution which assumes that every tapplet's metadata is stored in a separate folder, each version in a subfolder. Tapplets themself are distributed as zip bundles, so the code is not stored in the folder. Tapplet Registry manifest file, named `tapplets-registry.manifest.json`, keeps metadata about verified and listed tapplets.

tapplets-registry.manifest.json
```

## Tari Blockchain
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: Usually "Tari Blockchain" refers to the Layer 1, since the L2 is not a blockchain per sê. Tari Network, or L2, is more unambiguous.


## Github Repository

Github repository is the solution which assumes that every tapplet's metadata is stored in a separate folder, each version in a subfolder. Tapplets themself are distributed az zip bundles, so the code is not stored in the folder. Tapplet Registry manifest file, named `tapplets-registry.manifest.json`, keeps metadata about verified and listed tapplets.
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If I understand this right:
All curated tapplets' source code will be stored together in a single monolithic Github repo.
I guess this means that to add your app to the registry, you open a PR adding your code to the monolith. Is this right?

Edit: My question is answered below. I'll leave this comment in as an indication that it took a while to grok what this paragraph was saying.

Comment on lines +151 to +152
1. Mark the version as “deprecated” - special optional tag like “status” can be used
2. Update the Tapplet Registry and remove the tapplet from the list available ones
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ok, I asked about this in RFC-1101.
So, there's a high degree of trust being placed in the maintainers of the registry repo.

It would be good to make this trust model explicit somewhere.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

4 participants