asdf-vm / asdf-vm/asdf-plugins
Single repository for all plugins
- Dominant language
- Shell
- Stars
- 1.4k
- Forks
- 552
- PR merge metrics
- No merged PRs in 30d
Description
### Is your feature request related to a problem? Please describe
Currently, each plugin has its own repository, owner, and per consequence development/review process and opinions.
Having the official plugins in such a fashion can be very insecure as the repositories can be exposed to bad actors, either with the consent of the plugin maintainers or by accident, via faulty reviews or security leaks of said accounts. Plugins can also be abandoned or deleted at will.
This is in my opinion a *huge* security threat, as we can't blindly trust all the different parties involved in plugins installs and updates.
### Describe the proposed solution
Similar to how other tools handle it ([homebrew](https://github.com/Homebrew/homebrew-core/tree/master/Formula), [nixpkgs](https://github.com/NixOS/nixpkgs/tree/master/pkgs), [oh-my-zsh](https://github.com/ohmyzsh/ohmyzsh/tree/master/plugins)) would be to keep all the plugins in a single repository.
Benefits:
- Changes would be reviewed in a standardized manner and in a controlled fashion. All PRs could be audited for security and deviations of the `asdf-core` philosophy.
- We could easily address updates and security fixes.
- Testing all packages could be a lot better. And installing/updating plugins could be simplified, as we wouldn't necessarily need to run `plugin-add`, all plugins would already be installed always.
I could work on this solution if the idea ever gets greenlighted.
### Describe similar `asdf` features and why they are not sufficient
NA
### Describe other workarounds you've considered
NA
Contributor guide
Research direction
Start by reviewing the current per-plugin repository, ownership, review, installation, and update processes described in the issue. Define the migration, security review, testing, and maintenance requirements for a single official plugin repository; done would require an agreed design and greenlight, not just an isolated code change.
Written by the indexing model from the issue text.
Assessment
- Domain
- security, tooling
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100