mudler-agentandEttore Di Giacinto
f8b7576dc7
A development add-on entry now names a moving tag, sets mutable and has no digest, the same shape a development backend entry has. A release entry stays pinned by digest. One helper, catalog.Pin, turns a mutable entry into a digest at install: it resolves the tag, checks the digest form and builds the version from the first 12 hex digits. The backend library installer and the add-on installer both call it. The add-on installer then verifies the signature against the resolved digest and records that digest in the receipt. Kind, platform and install label checks stay in each caller. The official index lists the development entries as <id>-development, which the publish workflow already moves in its promote job. The catalog command renders the development channel as mutable entries. The update check reports no state for a mutable entry until it resolves the tag too. Assisted-by: Claude:claude-sonnet-5-5 [Claude Code] Signed-off-by: Ettore Di Giacinto <mudler@localai.io> Co-authored-by: Ettore Di Giacinto <mudler@localai.io>
First-party add-on catalog
This directory holds the template of the catalog entries of the first-party add-ons.
It holds no live URL, registry or namespace. The registry and repository are inputs of
the release workflow (ADDON_OCI_REPOSITORY). Each first-party add-on has its own
template (tables, voice, face, fine-tuning, quantization, studio, talk) and its own release
platform matrix, addons/<id>/package/platforms.yaml. The templates differ in name: only.
Render entries
go run ./scripts/addons/cmd/addonpkg catalog \
--config addons/tables/package/platforms.yaml \
--template gallery/addons/tables.yaml.tmpl \
--merged <merged layout> \
--repository <registry>/<namespace>/<repository> \
--tag <immutable tag without the id prefix: the version or sha-<12 hex>> \
--channel <latest | development | branch-...> \
--owner-repo <owner>/<repository> \
--signer-ref <refs/tags/vX.Y.Z | refs/heads/master> \
--out <catalog.yaml>
To render the entries of another package, name its matrix and its template. For example, for Voice:
go run ./scripts/addons/cmd/addonpkg catalog \
--config addons/voice/package/platforms.yaml \
--template gallery/addons/voice.yaml.tmpl \
--merged <merged layout of voice> ... # the other flags as above
Use face, fine-tuning, quantization, studio or talk in place of voice for the other packages.
All packages share one repository, so pass the same repository for each. The artifact of an
entry is oci://<repository>:<id>-<tag>, for example ...:voice-sha-50f0f3de26d2.
The add-on packages live in quay.io/go-skynet/local-ai-addons; the template itself holds
no registry value. The result is a YAML list with one entry for each enabled platform. Each entry:
- pins the digest of the platform image, so a tag that moves later changes nothing;
- names
oci://<repository>:<id>-<tag>for the immutable tag of that add-on; - carries the channel it is current for and the version of the package, so the channel is metadata that maps to a digest;
- states the signature policy: signature required, issuer
https://token.actions.githubusercontent.com, identityhttps://github.com/<owner>/<repository>/.github/workflows/addons-package.yml@<signer ref>.
The command fails when the repository is empty or a backend image repository, when the channel is not a channel alias, when a platform of the matrix has no image, or when the template holds an unknown placeholder or weakens the policy.
Placeholders
{{addon}}, {{version}}, {{tag}}, {{channel}}, {{repository}}, {{digest}},
{{os}}, {{arch}}, {{issuer}}, {{identity}}, {{title}}, {{description}},
{{main_page}}, {{icon}}. The title, description, main page and icon come from the
verified manifest of the package.
Signature policy of the library
The host replaces the policy of an entry with the policy of the library (source) that serves it. Configure the library with signature required, the issuer above and the identity of the entries. The identity is an exact string and carries the ref of the signing run, so one library names the identity of one release ref. A pattern is not supported by the library policy today.