Package Registry related ToDo list

[KN4CK3R]

Now that #16510 got merged there are still some ToDos.

General:

• Add a webhook for packages without repository relation (Decouple HookTask from Repository #17940, Delete only HookTasks of the repository #17981)
• Enable/Disable packages on organisation level
• Enable/Disable packages on repository level (disable linking packages to that repository and hiding the packages tab)
• Fine-granular access model (Permissions for package repositories #20596)
• Deletion policy (prevent deletion after x hours or something, Add support for npm unpublish #20688 (comment))
• Proxy for remote package registries (Support proxy registries for each package type #21223)
• Automated deletion of packages (Automated deletion for images in the container registry #20514, Data retention settings for package registry #20766)
• npm search support (Package Registry for NPM doesn't support search API endpoints #20098, NPM Package Registry search API endpoint #20280)
• Set repository link from package metadata (npm packages: respect "repository" field to automatically set repository link of uploaded packages #20146, Automatically link NuGet package to repository based on RepositoryUrl #20912, Pushing docker image appears in organization packages, but not in sub project packages #26065, [Feature] Automatically connect a package release to a specific repositiory (specifically looking at container registries right now) #28540)
• Display if a repo has linked packages in repo lists (asked in Missing info about docker image size #20909)
• Support for scoped access tokens (Support scoped access tokens #20908)

Package Types:

• Alpine packages (Add Alpine package registry #23714)
• Ansible packages ([Feature] Ansible Galaxy package manager #29483)
• Cargo / Rust packages (Add Cargo package registry #21888)
• Chef (Add Chef package registry #22554)
• Conda packages (Add Conda package registry #22262)
• CRAN packages (Add CRAN package registry #22331)
• Debian packages (Debian apt package & yum package registry #20751, Add Debian package registry #22854)
• Flatpak (Flatpak package registry #22415)
• Go packages (GOPROXY protocol support #7608, Add Go package registry #24687)
• JSR packages (https://jsr.io/docs/api#jsr-registry-api)
• Pub packages (Support for pub packages #19421)
• RPM packages (Debian apt package & yum package registry #20751, Add RPM registry #23380)
• Swift (Add Swift package registry #22404)
• Terraform (requested by Add Package Registry #16510 (comment))
• Vagrant boxes (Add support for Vagrant packages #20930)

[lunny]

https://github.com/boskiv/go-open-registry is a cargo registry Golang implementation .

[lunny]

You can also consider add #7608 to todo list.

[KN4CK3R]

https://github.com/boskiv/go-open-registry is a cargo registry Golang implementation .

That project still uses a git repo as storage. We could use that approach too but at the moment we can't set a repository to "hidden" to hide it from the normal repository view pages etc.

[wxiaoguang]

It seems that packages/packages.go:353:Cleanup need to be polished.

Everytime I run Gitea, I see the error 😂

2022/04/01 10:48:27 ...packages/packages.go:353:Cleanup() [E] [624667fb-15] hier2

[KN4CK3R]

Everytime I run Gitea, I see the error 😂

😢 #19293

[wxiaoguang]

Some links in i18n are 404 (update: duplicate with justusbunsi's #19315 )

[mscherer]

One feature that I think would benefit public forges is adding a quota system (eg, make sure a user/org can't take all the storage). While the problem already exist for repositories (folks can just commit tarball after all), I think binary packages would make it worst and limits would be easier to reach by regular users.

[justusbunsi]

Not sure if this feedback should be in this issue. If not, let me know:

• Linking packages to a repository seem to not work; neither inside an organization nor for user related packages. The dropdown list cannot be opened.
• Docs reference pointing to https://docs.gitea.io/en-us/<type>/ should be https://docs.gitea.io/en-us/packages/<type>/ (Fix links to packages documentation #19315)

NPM/Yarn

• Support yarn add <package>
• Packages with dependencies not published along with package inside Gitea will prevent a successful npm install <package>

Container Images

• Pull command in package overview contains port 3000

[KN4CK3R]

Linking packages to a repository seem to not work; neither inside an organization nor for user related packages. The dropdown list cannot be opened.

That should work (for public repositories). There may be a bug which hides private repos but I could not verify that. Does the html source contains the repo names?

Support yarn add <package>

What do you mean? As addition to the npm install instruction?

Packages with dependencies not published along with package inside Gitea will prevent a successful npm install <package>

I don't think the registry should prevent that. Isn't that up to the user?

Pull command in package overview contains port 3000

That's correct and ok. If you use a "normal" port like 80 or 443 only the url is displayed. But if the registry uses a different port it needs to be specified.

gitea/modules/setting/packages.go

Lines 34 to 37 in be9ef15

	Packages.RegistryHost = Domain
	if (Protocol == HTTP && HTTPPort != "80") || (Protocol == HTTPS && HTTPPort != "443") {
	Packages.RegistryHost += ":" + HTTPPort
	}

[justusbunsi]

That should work (for public repositories). There may be a bug which hides private repos but I could not verify that. Does the html source contains the repo names?

I configured everything (org + repo) as private. That would explain it.
Regarding html source I need to check again. I remember there was a value for the drop down list. But nothing was visible in the UI.

What do you mean? As addition to the npm install instruction?

Yes. I had issues with using yarn add instead of npm install. I'll have another closer look at that part. Maybe I have some misconfiguration which also causes the dependency issue.

If you use a "normal" port like 80 or 443 only the url is displayed.

Thats odd. I ran the latest dev docker image of Gitea and had a reverse proxy in front of it. I even configured ROOT_URL. So my instance is available at https://git.example.com (port 443) and I am able to push the image to this endpoint. But inside the pull command port 3000 is shown.