The marketplace

Templates and plugins for voidbase, written by the people who use it, at marketplace.voidbase.cloud. Your code stays in your repository; a listing points at it and records what our checks found on the day it was added. For a plugin that record names the commit it audited, and an instance fetches the plugin's files at that commit and hashes them itself. Nobody builds anything: not you, not the marketplace.

What works, and what does not

• You can list a template, and you can start from one. GitHub's own Use this template button clones the repository into your account, and voidbase init --template <name> downloads it from the listing; the templates page has both.
• You can list a plugin, and you can install one. voidbase plugins add <name> fetches the plugin's files at the commit this marketplace approved into pb_plugins/<name> and pins that commit and a hash of the files in voidbase.lock; the instance recomputes the hash before it loads anything. A cloud instance installs from its page on voidbase.cloud through the instance's own installer. The plugins page is the whole of it.
• You are not tied to this marketplace. What it serves under /registry/v1/ is the registry protocol, three GETs defined in voidbase that any marketplace can serve and any instance can read; --marketplace <url> installs from another on your own checkout, and a running instance then trusts it for that plugin.
• There are no accounts, downloads or rankings, and nothing to pay. Nothing to sign in to and nothing counted. Getting paid says what that means for charging.

The registry is a file

registry/templates.json and registry/plugins.json are the listings, and registry/v1/ is what is served: the index and one record per plugin version, naming the commit it approved, all written by the pipeline and committed to a public repository. Together they are the whole database. A listing therefore arrives as a commit: readable, reviewable, revertable, and arguable. That is deliberate, and it is the same reason the rest of voidbase keeps configuration in git rather than in a database. The site is prerendered from those files.

Being listed is not an endorsement. The audit is deterministic and recorded, a first pass and not a guarantee; it looks at one commit on one day, and it never runs the code. Read anything before you run it.

How a listing arrives, and leaves

A submission is a GitHub issue from a form, and the marketplace handles it itself. The repository's webhook audits a submission when it is opened or edited and answers with a comment. One a maintainer labels approved is listed: a template is added to the listing; a plugin is built, audited and hashed as well. The listing is committed, pushed, answered and closed, and the push deploys. A new plugin version is a tag on your repository: a daily check asks every listed repository for its tags and publishes the versions this marketplace does not serve yet. A listing leaves through an issue titled [remove] owner/name: once approved, the entry leaves the listing and a plugin's served versions leave the registry, in one commit. Instances that installed it keep what they have.

Publishing