Packages and images: a registry beside each repository, built and receipted by Flow issue #269
open andymccall opened this · 0 comments
andymccall
From the competitor comparison (2026-10-19): GitHub Packages, GitLab's package and container registries, Codeberg (Forgejo packages) host packages beside the code; OxygenHub only serves an apt repository for its own releases and Flow's rootfs images.
Goal: a repository's releases and images live next to its code, with the same trust: each package is built by OxygenFlow, named by the run's signed receipt, and verifiable offline.
Formats, in order: OCI images (Docker/Podman pull, and Flow's own images, unifying with oxygenflow#25), Cargo (sparse registry protocol), npm, apt (generalising the hub's own /apt to any repository), generic files.
Publishing: from a Flow job's outputs (oxygenflow#26 publish step), so provenance is the receipt; manual upload with a token allowed but marked "not built here".
Access: follows the repository's visibility and roles; tokens scoped packages:read/write.
Storage: content-addressed blobs in the hub's store or the owner's bucket (oxygenhub#96), deduplicated; retention and cleanup policies.
Trust page: each version shows its receipt, the state it was built from, and the transparency-log entry (issue #238).
From the competitor comparison (2026-10-19): GitHub Packages, GitLab's package and container registries, Codeberg (Forgejo packages) host packages beside the code; OxygenHub only serves an apt repository for its own releases and Flow's rootfs images.
Goal: a repository's releases and images live next to its code, with the same trust: each package is built by OxygenFlow, named by the run's signed receipt, and verifiable offline.
packages:read/write.Large; design first (docs/packages.md).