geode-index

The package index for Geode, a Cargo-inspired package manager for GemStone/S.

This repository is a lightweight package index. It holds a single file — index.json — mapping package names to their git repositories and published versions. There is no server; the registry is just a git repo, and publishing a package is a pull request.

Disclaimer

Listing in this index is not an endorsement, security review, or quality assessment by GemTalk Systems. Packages are third-party code provided by their respective authors. You are responsible for evaluating each package's suitability, correctness, and security before use. The index and the packages it references are provided as-is, with no warranty of any kind.

How it is used

When you run geode add <name> without a --git URL, Geode clones this repository and looks up <name> in index.json to find the git URL to fetch from. When you run geode publish in a package's source tree, Geode opens a pull request against this repo that adds a new entry or appends a version to an existing one.

You can use Geode without this index — passing --git directly to geode add bypasses the registry entirely.

index.json schema

Each top-level key is a package name. Each value is an object with three fields:

{
  "seaside": {
    "git": "https://github.com/SeasideSt/Seaside",
    "versions": ["3.5.1", "3.5.0"],
    "description": "Web application framework for GemStone."
  },
  "zinc": {
    "git": "https://github.com/svenvc/zinc",
    "versions": ["1.3.1", "1.3.0"],
    "description": "HTTP client and server library."
  }
}

• git — the canonical git URL. Geode uses this to clone the package.
• versions — released versions, newest first. Each must correspond to a git tag of the form v<version> (e.g. v1.3.1) in the package's repository.
• description — one-line summary shown in listings.

Publishing a package

Two paths:

With geode publish (requires the gh CLI):

cd my-package
git tag v1.0.0 && git push --tags
geode publish

This opens a PR titled Publish <name> <version> that adds or updates the relevant entry in index.json.

Manually: fork this repo, edit index.json to add or update an entry, and open a pull request. Keep the JSON sorted alphabetically by package name and keep the version list newest-first.

Review criteria

Review is mechanical, not editorial. A maintainer will merge a PR when:

• The named git repository exists, is publicly readable, and contains a gemstone.toml at its root on the tagged commit.
• The tag v<version> exists and points at the commit the manifest describes.
• The package name is unique, follows the lowercase-with-hyphens convention (e.g. my-package, not MyPackage), and does not violate the name policy below.
• The description is a single line.

Package quality, maintenance status, test coverage, and security are not reviewed. See the disclaimer above.

Name policy

Names are assigned first-come-first-served, with the following restrictions. A submitted name must not:

• Match the name of an existing package (use a different name, or contact the current holder to request transfer).
• Impersonate a well-known project or author.
• Be confusingly similar to a reserved name: geode, gemstone, standard GemStone class names, or the names of core GemStone products.
• Be offensive or misleading.

If a package has been published under a name that belongs to an established upstream project (for example, a third party registers seaside before the Seaside maintainers do), the authentic project may request transfer by opening an issue with evidence of ownership — a link to the canonical repository, commit history, or similar. Maintainers will transfer the entry after a reasonable review period.

Removing a package

Author-requested removal: open a PR deleting the entry from index.json.

Removal for cause: maintainers may remove or modify entries without the author's consent when a package:

• Distributes malware, backdoors, or intentionally harmful code.
• Impersonates another project or author.
• Violates intellectual property rights (including DMCA takedowns).
• Becomes unreachable (the linked repository has been deleted or made private with no replacement).

Report concerns by opening an issue or contacting the maintainers directly. Removals for cause are exceptional; the default is to leave the index as-is.

Existing gemstone.lock files that pin a specific SHA continue to resolve after an entry is removed, since the lockfile holds the SHA directly rather than consulting the registry.