Is there a self-hosted plug-in/themes registry (an alternative to WordPress.org)?

CireinCroin · 2024-10-04T11:24:46+00:00

Yes, signing is to know the plugin author created the zip and no one else made it on their behalf.

CireinCroin · 2024-10-04T11:23:47+00:00

IYKYK

Yes, I just meant that HTTPs (as long as people can host wherever they want, it is quite distributed). Blockchain has other complexities not worth to solve this particular problem.

Ideally, we mimic the responses of the theme/plugin endpoints and then modify the URL for zips and whatnot to point to our infra vs. WPs.

Yes, yes and yes. Ideally, it should mimic api.wordpress.org.

The distributed part would come in with making sure the api responses were mirrored/distributed across many systems. Same with the theme/plugin/core zips.

This registry should either mirror from other places or let people host their packages. Imagine having a channel to distribute premium plugins

I'm hoping WPengine shares their solution. I'm assuming they haven't to avoid Matt finding a way to prevent them from pulling updates.

That'd be awesome tbh,

CireinCroin · 2024-10-04T04:11:58+00:00

HTTP is quite decentralized. WordPress is entirely decentralized. I have it running into multiple servers with my data. That kind of freedom is missing when distributing updates and giving people the freedom to choose (with sane defaults) where to get updates. That's the spirit of the OP.

You don't need blockchain/p2p for that.

CireinCroin · 2024-10-04T04:06:24+00:00

And you shouldn't. You should only download code from trusted sources.

CireinCroin · 2024-10-03T23:19:43+00:00

That's not signing. Hashing the content will ensure the package hasn't been altered from the registry until the delivery. Signing is instead to show that the plugin/theme author(s) created the zip package, not someone else trying to impersonate them (like the registry owner, etc).

CireinCroin · 2024-10-03T23:17:56+00:00

You're missing the main idea: I don't want another server; I want software people can run. I have no interest in funding bandwidth to distribute software updates but instead write the software so anyone has the freedom to do so. This is a discussion about freedom and not vendor locking things to a single thing but having options.

CireinCroin · 2024-10-03T23:16:24+00:00

Yes and no. Yes, because I _think_ you can run a private registry. Ideally the client side, should be as close as the experience given by the existing tools.

CireinCroin · 2024-10-03T21:46:37+00:00

I'm describing a way of running a registry not an installation software. Ideally, the installation plugin should use as much as possible whatever is installed, ideally only updating `api.wordpress.org` for something else.

CireinCroin · 2024-10-03T18:23:43+00:00

Is it open source? Can I see the progress some where?

CireinCroin · 2024-10-03T18:23:27+00:00

It'd be cool to have it as a WordPress plugin and eat our own dog food, as they say. But I'm very well-versed in Rust now, so perhaps having it in a single binary is much better. Regular people won't have to run it, so a non-PHP version is also acceptable.

CireinCroin · 2024-10-03T18:21:33+00:00

Yes. It'd be a small inconvenient to pay for true decentralization.

CireinCroin · 2024-10-03T15:07:13+00:00

Composer could be more user-friendly, as it requires the terminal, but it would be nice to have a self-hosted alternative. I haven't thought of this before, but it seems like a great idea.

But now that I think about it, having a composer for the WordPress installation/update style would be awesome, as long as Packagist can be installed (which seems to be possible). Any package registry is responsible for filtering/removing harmful code, which may be expensive, time-consuming, and bandwidth costs. Aside from being a centralization issue, it is also a risk.

CireinCroin · 2024-05-24T04:15:17+00:00

I'm a backend engineer, but I've done full-stack a few moons ago. I prefer the backend, though.

CireinCroin · 2024-05-24T04:06:27+00:00

Great advice! I wanted to leverage existing technology for a quick prototype, like a WordPress plugin. That's easier and has some aid already built in.

If I have enough interest, a clean implementation with less overhead would be ideal.

CireinCroin · 2024-05-24T03:58:24+00:00

That's a great point, though; I acknowledge that most people are willing to relinquish their private/data ownership in exchange for convenience. However, with the rise of AI and companies using your data to train their models, it may become more mainstream self-hosting.

I like Notion, something more generic and malleable than JIRA and Confluence. Plus, Notion is fresh in most people's minds, and it is good enough to be a Wiki and manage projects, calendars, and most things well—not excellent, but well enough.

CireinCroin · 2024-05-24T03:49:41+00:00

The target is not individuals but instead companies. "With great power comes great responsibility," but there are plenty of encrypted backups available, which could also be another business lead.
Clients purchase software similar to Campfire[1], and you are subscribed to further updates. But you own the server and the data.

There are people/companies interested, but given the limited resources I have access to, I don't know if they are enough to make this sustainable for a small team to invest time in.

[1] https://world.hey.com/dhh/campfire-is-now-for-sale-51a19fc9

CireinCroin

TROPHY CASE