{"action":"created","issue":{"url":"https://api.github.com/repos/redox-os/redox/issues/54","labels_url":"https://api.github.com/repos/redox-os/redox/issues/54/labels{/name}","comments_url":"https://api.github.com/repos/redox-os/redox/issues/54/comments","events_url":"https://api.github.com/repos/redox-os/redox/issues/54/events","html_url":"https://github.com/redox-os/redox/issues/54","id":109635982,"number":54,"title":"A proposal for Ox","user":{"login":"Ticki","id":13349091,"avatar_url":"https://avatars.githubusercontent.com/u/13349091?v=3","gravatar_id":"","url":"https://api.github.com/users/Ticki","html_url":"https://github.com/Ticki","followers_url":"https://api.github.com/users/Ticki/followers","following_url":"https://api.github.com/users/Ticki/following{/other_user}","gists_url":"https://api.github.com/users/Ticki/gists{/gist_id}","starred_url":"https://api.github.com/users/Ticki/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Ticki/subscriptions","organizations_url":"https://api.github.com/users/Ticki/orgs","repos_url":"https://api.github.com/users/Ticki/repos","events_url":"https://api.github.com/users/Ticki/events{/privacy}","received_events_url":"https://api.github.com/users/Ticki/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-10-03T17:55:12Z","updated_at":"2015-10-03T21:03:49Z","closed_at":null,"body":"Proposal for the `ox` package manager (Redox)\r\n========\r\n\r\nThis is a proposal for the ox package manager for redox.\r\n\r\n## Principles\r\n\r\nOx shall be modular, simple and decentralised. Ox shall both be\r\ncapable of compiling from source and installing binaries directly.\r\nFuthermore, Ox shall be secure.\r\n\r\n## How Ox works\r\n\r\nOx works over HTTP(S) protocole. Ox is consisting of two types of\r\ndata sources:\r\n- Repositories\r\n- Package hosts\r\n\r\n### Repositories\r\n\r\nIn this context, a repository (or repo for short) is a place\r\nstoring various information about packages. These includes:\r\n- Where the package can be downloaded (package host)\r\n- What the hashes of the binaries and the source are.\r\n- The hash of the package's public key (which is owned by the\r\n  package developer). This ensures that the user will be able\r\n  to securely get the latest version without worrying about\r\n  the security of the connection/provider.\r\n\r\nThere is not one central repository. The user adds repositories,\r\nhe or she trusts. The repository *X* (name) from *Y* (host) can\r\nbe found in http(s)://ox.[*Y*]/*X*.oxr.\r\n\r\nThis is recommended to be over a HTTPS connection, however this\r\nis not required (although a warning is given if not).\r\n\r\nThis file is of the format:\r\n```\r\n[name of the package]:[version]:[description of the package]:[hash of the binary]:[hash of the source code]:[hash of the developers public key]\r\n[name of the package]:[version]:[description of the package]:[hash of the binary]:[hash of the source code]:[hash of the developers public key]\r\n[name of the package]:[version]:[description of the package]:[hash of the binary]:[hash of the source code]:[hash of the developers public key]\r\n...\r\n```\r\n\r\n### Package hosts\r\n\r\nThe package *X* of version *V* from *Y* can be found in\r\n`http(s)://ox.[*Y*]/[*V*]-[*X*].oxp`. This is a file of the format\r\n\r\n```\r\nname=[name]\r\nauthor=[author]\r\ndescription=[description]\r\nversion=[version]\r\nbin=[path to binary]\r\nsource=[path to source]\r\ncompile=[path to compile script]\r\npublickey=[public key of the developer]\r\nsignature=[digital signature of the files]\r\nfiles=[files provided in the package]\r\ndependencies=[list of packages this package depends on (includes versions)]\r\n```\r\n\r\nThe hash of the binary/source is checked, of course (using the\r\nhash from the repositories). So is the signature.\r\n\r\nIf the version is set to `_` the latest version of the package\r\nis returned. To make sure that this package is safe, the signature\r\nis checked (using the signature in the repository). If no developer\r\nsignature is found in the repository a warning is returned.\r\n\r\n## Installation\r\n\r\nInstallation is done via downloading the binary and running it while\r\ntracking the files it creates. These are stored together with the\r\n`files` parameter given by the package host. These are used if the\r\nuser wants to uninstall the package.\r\n\r\n\r\n## The CLI\r\n\r\n### `ox get [package]`\r\n\r\nInstalls `[package]` using the binary. If multiple packages named\r\n[package] are found in the repositories, the user is asked to\r\nchoose the package.\r\n\r\n### `ox get -c [package]`\r\n\r\nInstalls [package] from the source.\r\n\r\n### `ox remove [package]`\r\n\r\nRemove [package] including files that it has created.\r\n\r\n### `ox add [repository name and host]`\r\n\r\nAdd a new repository.\r\n\r\n### `ox clean`\r\n\r\nCleans up all orphaned packages.\r\n\r\n### `ox update`\r\n\r\nUpdates the repositories.\r\n\r\n### `ox upgrade`\r\n\r\nInstall all new upgraded packages.\r\n\r\n## Unresolved questions, TODOs etc.\r\n\r\nLots of things. For example:\r\n\r\n- How will `ox` manage multiple versions of the same package?\r\n- In what language will compile scripts be written?"},"comment":{"url":"https://api.github.com/repos/redox-os/redox/issues/comments/145290944","html_url":"https://github.com/redox-os/redox/issues/54#issuecomment-145290944","issue_url":"https://api.github.com/repos/redox-os/redox/issues/54","id":145290944,"user":{"login":"stratact","id":13501315,"avatar_url":"https://avatars.githubusercontent.com/u/13501315?v=3","gravatar_id":"","url":"https://api.github.com/users/stratact","html_url":"https://github.com/stratact","followers_url":"https://api.github.com/users/stratact/followers","following_url":"https://api.github.com/users/stratact/following{/other_user}","gists_url":"https://api.github.com/users/stratact/gists{/gist_id}","starred_url":"https://api.github.com/users/stratact/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/stratact/subscriptions","organizations_url":"https://api.github.com/users/stratact/orgs","repos_url":"https://api.github.com/users/stratact/repos","events_url":"https://api.github.com/users/stratact/events{/privacy}","received_events_url":"https://api.github.com/users/stratact/received_events","type":"User","site_admin":false},"created_at":"2015-10-03T21:03:49Z","updated_at":"2015-10-03T21:03:49Z","body":"If we were to use the HTTPS protocol, does that mean we should also implement our own SSL/TLS implementation? For the sake of the security aspect of this project I would prefer to avoid using OpenSSL. Unless we have to use it, use LibreSSL instead since it's (mostly) API compatible and the OpenBSD folks include their own libtls implementation with it as well."}}