RFC: Buildpack Registry

[jkutner]

Readable

[jonjohnsonjr]

Have you looked at https://github.com/opencontainers/artifacts?

[jonjohnsonjr]

This is really interesting. I've love something like this to just front arbitrary registries with a vanity domain.

Aggregating across multiple registries is a cool idea, that could help with a lot of different problems. You could potentially use this to pull a buildpack/image by digest without having to specify a location cc @jchesterpivotal @dprotaso

• How will we index buildpacks to facilitate searching?
• How will we index buildpacks to facilitate fast resolution (w/o spamming the registry)?

It's essentially impossible to do this right now in a portable way, see opencontainers/distribution-spec#22

You should get involved in steve's efforts to define search requirements.

The registry will not store any secrets. It will only store a mapping of Buildpack Registry account to third-party account.

Somewhat related is signing artifacts.

Keeping in sync with the registries you're fronting will be tough. What happens if someone deletes a buildpack from the underlying registry?

I'll also reiterate that it's important to be careful in writing any software that assumes a central registry. A lot of problems were caused by a dockerhub default, e.g.:

• Parsing references to images is hard (i.e. ambiguous) because omitting the registry defaults to dockerhub.
• For a long time, it was impossible to set up a mirror for anything other than docker. Related.

[jkutner]

@jonjohnsonjr thanks for taking a look! The signing stuff in particular is very interesting, and I'll read up on the search requirements.

The "keeping in sync" part is tricky, and I'll add that to Risks. I think deletion is the main concern (as opposed to pushing new tags in a repo w/o a corresponding buildpack).

With regard to it being a central registry, my hope is that it not. Heroku will run it's own instance (and may actually run several). I can image users wanting to run per-cluster instances of a buildpack registry too (to support private buildpacks).

[jonjohnsonjr]

Steve opened some issues for signing and search if you're interested in participating in those conversations:
opencontainers/distribution-spec#70
opencontainers/distribution-spec#71

[wking]

With a temporary signing keypair and only the signature in the buildpackage, how does the consumer find and trust the public key they use to verify the signature?

[wking]

Ah, this is just about verifying the push to registry, not about end users verifying anything. The buildpack registry can just hold the public key in a local cache. Sorry for the noise.

[jkutner]

closing in favor of #35