Search Apps Documentation Source Content File Folder Download Copy Actions Download State String Boolean Number Struct Map Slice Pointer Function Closure Reference Nil Package Type Interface Unknown

registry/v0 package

Overview

Package registry is an open, on-chain map from a deployed gno package path back to the source that produced it: repository, commit, directory.

It is the realm half of gno.land/p/moul/gnopm/v0, which holds the domain model and the whole of the reasoning; this file is wiring. Every exported mutation is a crossing function that resolves the caller, forwards to the library, aborts on error (the only way to revert state in gno) and emits an event for indexers.

It cannot promise, and does not pretend to

Nothing here is verified and nothing here can be. A realm cannot clone a repository, so it cannot check that the bytes at the claimed commit are the bytes deployed at the claimed path. What it stores is testimony under a signature: this address says this package came from that source.

That is still worth storing, for two reasons.

First, it is testimony in the exact shape a verifier needs. Path, repository, commit and directory are precisely the four inputs to "hash the addpkg payload of that directory and compare it with what the chain hands back", which gnopm already does against a local tree (`gnopm verify -deployed`). The registry does not answer the question; it makes the question answerable by anything that can clone.

Second, the chain knows who signed. A claim from the address that owns the package path's namespace comes from the party that controls the path, and OwnedBy reports that. It is computed on every read, never stored, because a name can be transferred and a stored answer would rot into exactly the kind of stale claim this realm exists to distinguish from a live one.

Open, and tagged

Anyone may claim any path, including one they had nothing to do with. That is deliberate: gating registration on namespace ownership would leave the map empty on day one, when almost nothing has been registered by its own deployer, and an empty registry teaches nobody anything. A stranger's claim is not suppressed, it is labelled and ranked below the owner's, and Render never presents an unverified claim as a fact.

A claimant may always withdraw their own claim, and may never touch anyone else's.

Function

Register

func Register(cur realm, pkgPath, repo, commit, dir, ref string)

Register records that pkgPath was built from dir of repo at commit.

Calling it again for the same path replaces the caller's own claim and nobody else's, so moving a claim to a new commit after a redeploy is one call with no read first.

ref is optional and is never the thing verified: a ref moves, a commit does not. It is recorded so a reader can tell a claim pinned to a released tag from one pinned to a commit on nobody's branch, and so a verifier can report a commit that has since been orphaned by a force-push.

dir is empty when the package sits at the repository root.

Params

Command

# WARNING: This command is running in an INSECURE mode.
# It is strongly recommended to use a hardware device for signing
# and avoid trusting any computer connected to the internet,
# as your private keys could be exposed.

gnokey maketx call -pkgpath "gno.land/r/moul/gnopm/registry/v0" -func "Register" -args $'' -args $'' -args $'' -args $'' -args $'' -gas-fee 1000000ugnot -gas-wanted 1_000_000_000 -send "" -chainid "gnoland-1" -remote "https://rpc.gno.land" ADDRESSgnokey query -remote "https://rpc.gno.land" auth/accounts/ADDRESS
gnokey maketx call -pkgpath "gno.land/r/moul/gnopm/registry/v0" -func "Register" -args $'' -args $'' -args $'' -args $'' -args $'' -gas-fee 1000000ugnot -gas-wanted 1_000_000_000 -send "" -broadcast=false ADDRESS > call.tx
gnokey sign -tx-path call.tx -chainid "gnoland-1" -account-number ACCOUNTNUMBER -account-sequence SEQUENCENUMBER ADDRESS
gnokey broadcast -remote "https://rpc.gno.land" call.tx