-
Notifications
You must be signed in to change notification settings - Fork 18
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
feat: rfc-1102 tapplet registry #138
base: main
Are you sure you want to change the base?
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Possible con for NPM: There is a risk of dependencies introducing vulnerabilities (supply chain attack)
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
A few nits. But LGTM
src/RFC-1102_TappletsRegistry.md
Outdated
|
||
## Github Repository | ||
|
||
Github repository is the solution which assumes that every tapplet's metadata is stored in a separate folder, each version in a subfolder. Tapplets themself are distributed az zip bundles, so the code is not stored in the folder. Tapplet Registry manifest file, named `tapplets-registry.manifest.json`, keeps metadata about verified and listed tapplets. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Github repository is the solution which assumes that every tapplet's metadata is stored in a separate folder, each version in a subfolder. Tapplets themself are distributed az zip bundles, so the code is not stored in the folder. Tapplet Registry manifest file, named `tapplets-registry.manifest.json`, keeps metadata about verified and listed tapplets. | |
Github repository is the solution which assumes that every tapplet's metadata is stored in a separate folder, each version in a subfolder. Tapplets themself are distributed as zip bundles, so the code is not stored in the folder. Tapplet Registry manifest file, named `tapplets-registry.manifest.json`, keeps metadata about verified and listed tapplets. |
src/RFC-1102_TappletsRegistry.md
Outdated
tapplets-registry.manifest.json | ||
``` | ||
|
||
## Tari Blockchain |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
nit: Usually "Tari Blockchain" refers to the Layer 1, since the L2 is not a blockchain per sê
. Tari Network, or L2, is more unambiguous.
src/RFC-1102_TappletsRegistry.md
Outdated
|
||
## Github Repository | ||
|
||
Github repository is the solution which assumes that every tapplet's metadata is stored in a separate folder, each version in a subfolder. Tapplets themself are distributed az zip bundles, so the code is not stored in the folder. Tapplet Registry manifest file, named `tapplets-registry.manifest.json`, keeps metadata about verified and listed tapplets. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
If I understand this right:
All curated tapplets' source code will be stored together in a single monolithic Github repo.
I guess this means that to add your app to the registry, you open a PR adding your code to the monolith. Is this right?
Edit: My question is answered below. I'll leave this comment in as an indication that it took a while to grok what this paragraph was saying.
1. Mark the version as “deprecated” - special optional tag like “status” can be used | ||
2. Update the Tapplet Registry and remove the tapplet from the list available ones |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Ok, I asked about this in RFC-1101.
So, there's a high degree of trust being placed in the maintainers of the registry repo.
It would be good to make this trust model explicit somewhere.
914719a
to
48ba395
Compare
The Tapplets Registry is the fundamental part of the Tari Universe. This RFC propose the registry structure as well as manifest file as list of registered and verified tapplets.