Modules and package management proposal v3

[rogpeppe]

Modules and package management proposal v3

This discussion is for a proposal on how CUE can fully support package and dependency management.

It follows two earlier proposals:

• V1: #851
• V2: #2330

Since V2, many people have provided their feedback and experimental code, now
part of the CUE repository, has been written that implements a form of the proposal.
This discussion presents a revised form of the proposal in the light of the above.

The revised proposal can be found here:

https://github.com/cue-lang/proposal/blob/main/designs/modules.v3/2939-modules.md

It incorporates the following sub-proposals:

• Proposal: CUE modules storage model V3 · cue-lang/cue · Discussion #2941
• Proposal: CUE modules Supply Chain Security V3 · cue-lang/cue · Discussion #2942
• Proposal: Module backwards compatibility V3 · cue-lang/cue · Discussion #2943
• Proposal: Determining what files go into a CUE module · cue-lang/cue · Discussion #3017
• Proposal: module metadata · cue-lang/cue · Discussion #3057

To summarize the principal differences from V2 of the proposal:

• the OCI distribution specification is now used as the standard module storage API
• the module-publishing app proposal (Proposal: Module-publishing GitHub app #2448) has now been dropped in favor of
  pushing directly to a registry.

Some aspects of #2330 remain relevant but have not yet been implemented. Specifically:

• there is no explicit support for supply-chain security (Proposal: CUE modules Supply Chain Security V3 #2942) beyond whatever is
  provided by the OCI registry itself
• there is no implementation of any backward-compatibility checks (Proposal: Module backwards compatibility V3 #2943)

[infogulch]

All of the sub-proposal links to the proposal text are broken (404). Is this expected? Example:

See here for the sub-proposal text in full: https://github.com/cue-lang/proposal/blob/main/designs/modules/2942-supply-chain-security.md

[mvdan]

Thanks for the catch, all three markdown links should be fixed now.

[myitcv]

Based on the excellent feedback received from CUE users to date, and updates shared on the various modules update calls, the consensus appears to be that this proposal and its various sub proposals should be accepted.

As discussed on the 2024-05-02 modules update call, we are therefore moving this proposal and its sub-proposals to a status of "likely accept".

This marks the final period for comments that might change the recognition of consensus. We are aiming to conclude this decision at the next Modules Feedback session (2024/05/16). If there is no change in that consensus, we will accept the proposal and its sub-proposals on that date.

[myitcv]

On the 2024-05-16 Modules update call we accepted v3 of the modules proposal and its sub-proposals. Closing this discussion to recognise that decision.