asdf-vm / asdf-vm/asdf-plugins

Single repository for all plugins

Open
#612 8 comments 7 reactions 0 assignees View on GitHub
Dominant language
Shell
Stars
1.4k
Forks
552
PR merge metrics
No merged PRs in 30d

Description

### Is your feature request related to a problem? Please describe

Currently, each plugin has its own repository, owner, and per consequence development/review process and opinions.

Having the official plugins in such a fashion can be very insecure as the repositories can be exposed to bad actors, either with the consent of the plugin maintainers or by accident, via faulty reviews or security leaks of said accounts. Plugins can also be abandoned or deleted at will.

This is in my opinion a *huge* security threat, as we can't blindly trust all the different parties involved in plugins installs and updates.

### Describe the proposed solution

Similar to how other tools handle it ([homebrew](https://github.com/Homebrew/homebrew-core/tree/master/Formula), [nixpkgs](https://github.com/NixOS/nixpkgs/tree/master/pkgs), [oh-my-zsh](https://github.com/ohmyzsh/ohmyzsh/tree/master/plugins)) would be to keep all the plugins in a single repository.

Benefits:
- Changes would be reviewed in a standardized manner and in a controlled fashion. All PRs could be audited for security and deviations of the `asdf-core` philosophy.
- We could easily address updates and security fixes.
- Testing all packages could be a lot better. And installing/updating plugins could be simplified, as we wouldn't necessarily need to run `plugin-add`, all plugins would already be installed always.

I could work on this solution if the idea ever gets greenlighted.

### Describe similar `asdf` features and why they are not sufficient

NA

### Describe other workarounds you've considered

NA

Contributor guide

Open the contributing guide

Research direction

Start by reviewing the current per-plugin repository, ownership, review, installation, and update processes described in the issue. Define the migration, security review, testing, and maintenance requirements for a single official plugin repository; done would require an agreed design and greenlight, not just an isolated code change.

Written by the indexing model from the issue text.

Assessment

Domain
security, tooling
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.