Code Monkey home page Code Monkey logo

cli-plugin-repo's Introduction

Cloud Foundry CLI Plugin Repository (CLIPR)Build Status

Plugin Downloads Server Uptime

This is a public repository for community created CF CLI plugins. To submit your plugin approval, please submit a pull request according to the guidelines below.

Submitting Plugins

  1. You need to have git installed
  2. Clone this repo git clone https://github.com/cloudfoundry/cli-plugin-repo
  3. Include your plugin information in repo-index.yml, here is an example of a new plugin entry
- authors:
  - contact: [email protected]
    homepage: https://github.com/sample-author
    name: Sample-Author
  binaries:
  - checksum: 2a087d5cddcfb057fbda91e611c33f46
    platform: osx
    url: https://github.com/sample-author/new_plugin/releases/download/v1.0.0/echo_darwin
  - checksum: b4550d6594a3358563b9dcb81e40fd66
    platform: win64
    url: https://github.com/sample-author/new_plugin/releases/download/v1.0.0/echo_win64.exe
  - checksum: f6540d6594a9684563b9lfa81e23id93
    platform: linux32
    url: https://github.com/sample-author/new_plugin/releases/download/v1.0.0/echo_linux32
  company:
  created: 2015-01-31T00:00:00Z
  description: new_plugin to be made available for the CF community
  homepage: https://github.com/sample-author/new_plugin
  name: new_plugin
  updated: 2015-01-31T00:00:00Z
  version: 1.0.0

Please make sure the spacing and colons are correct and that the fields are alphabetized in the entry. The following describes each field's usage.

Field Description
authors Fields to detail the authors of the plugin
name: name of author
homepage: Optional link to the homepage of the author
contact: Optional ways to contact author, email, twitter, phone etc ...
binaries This section has fields detailing the various binary versions of your plugin. To reach as large an audience as possible, we encourage contributors to cross-compile their plugins on as many platforms as possible. Go provides everything you need to cross-compile for different platforms
platform: The os for this binary. Supports osx, linux32, linux64, win32, win64
url: A versioned HTTPS link to the binary file itself
checksum: SHA-1 of the binary file for verification
Use a unique URL that includes the release version for each release of your plugin, as each binary will have a unique checksum.
company Optional field detailing company or organization that created the plugin
created date of first submission of the plugin, in iso 8601 combined date and time with timezone format
description describe your plugin in a line or two. this description will show up when your plugin is listed on the command line
homepage Link to the homepage where the source code is hosted. Currently we only support open source plugins
name name of your plugin, must not conflict with other existing plugins in the repo. It must also match the name your plugin returns.
updated Date of last update of the plugin, in ISO 8601 Combined Date and Time with Timezone Format
version version number of your plugin, in [major].[minor].[build] form
  1. run go run sort/main.go repo-index.yml. This will sort your additions to the file.

  2. After making the changes, fork the repository

  3. Add your fork as a remote

    cd $GOPATH/src/github.com/cloudfoundry/cli-plugin-repo
    git remote add your_name https://github.com/your_name/cli-plugin-repo
    
  4. Push the changes to your fork and submit a Pull Request

Releasing Plugins

Cross-compile to the 3 different operating systems

Golang supports cross compilation to several systems and architectures. Theres an in-depth article by Dave Cheney here explaining how to do it and how it works. You can also find a list of supported systems and architectures here under the $GOOS and $GOARCH section.

The CF cli supports 5 combinations:

  • linux/386 (known as linux32)
  • linux/amd64 (known as linux64)
  • windows/386 (known as win32)
  • windows/amd64 (known as win64)
  • darwin /amd64 (known as osx)

And at a minimum we want plugins to support linux64, win64 and osx.

So, with all that, you can generate those binaries for your plugin with the following snippet:

PLUGIN_PATH=$GOPATH/src/my-plugin
PLUGIN_NAME=$(basename $PLUGIN_PATH)

cd $PLUGIN_PATH
GOOS=linux GOARCH=amd64 go build -o ${PLUGIN_NAME}.linux64
GOOS=linux GOARCH=386 go build -o ${PLUGIN_NAME}.linux32
GOOS=windows GOARCH=amd64 go build -o ${PLUGIN_NAME}.win64
GOOS=windows GOARCH=386 go build -o ${PLUGIN_NAME}.win32
GOOS=darwin GOARCH=amd64 go build -o ${PLUGIN_NAME}.osx

Sign Windows binaries

By signing the plugin binary, you can assure recipients that it did indeed come from you.
Although an optional step, unsigned binaries often cannot be used in locked-down machines common in organizations with stricter security policies. Signing the binary allows system admins to whitelist the plugin by signature or publisher.

The cf CLI binary is signed using a Cloud Foundry Foundation certificate. This certificate cannot be used to sign third-party plugins; plugin authors need to procure their own code-signing certificate.

You’ll need a code-signing certificate compatible with Microsoft Authenticode issued by a Microsoft-authorized certificate authority such as Thawte, Comodo, Symantec, or Digicert. A standard code signing certificate is sufficient - extended validation (EV) is not required. Buying direct from these CAs can be expensive. There are many resellers of certificates that pass on savings they get from volume discounts; you can shop around for a good price or support but fundamentally they’re all selling the same thing. You should expect an average price of between USD 80 and USD 150 for a one-year cert.

Once the certificate is obtained, refer to the following steps to sign your plugin binary.

CERT_LOCATION=my-cert-location
CERT_PASSWORD=my-cert-password
PLUGIN_BINARY_NAME=my-plugin.win32

mkdir signed-binaries
osslsigncode sign \
  -pkcs12 $CERT_LOCATION \
  -pass $CERT_PASSWORD \
  -t http://timestamp.comodoca.com/authenticode \
  -h sha256 \
  -in ${PLUGIN_BINARY_NAME} \
  -out signed-binaries/${PLUGIN_BINARY_NAME}
rm -f ${PLUGIN_BINARY_NAME}

Checksums

Checksums in the repo-index.yml file are used to verify the integrity of the binaries, to prevent corrupted downloads from being installed. We use the sha-1 checksum algorithm, you can compute it with: shasum -a 1 <myfile>

So continuing the above snipped you'd do:

shasum -a 1 ${PLUGIN_NAME}.linux64
shasum -a 1 ${PLUGIN_NAME}.linux32
shasum -a 1 ${PLUGIN_NAME}.win64
shasum -a 1 ${PLUGIN_NAME}.win32
shasum -a 1 ${PLUGIN_NAME}.osx

Take note of those so that you can put them on repo-index.yml later when you have uploaded the binaries.

Release the binary publicly

You could use whatever file hosting you like here, the easiest and recommended one is GitHub releases, given that your plugin's code is already hosted on GitHub it might be the easiest solution too.

You can read more about GitHub Releases here but for the purposes of releasing your plugin you should upload those five binaries generated above on the same release.

You should then copy the resulting links for the uploaded binaries from the release page and put them on the repo-index.yml file.

This process can get a little tedious if you do it manually every time, that's why some plugin developers have automated it. You can probably put together scripts based on the snippets above to automate compiling, generating checksums and uploading the release to GitHub. There are tools available to manage GitHub releases such as this one.

Running your own Plugin Repo Server

Included as part of this repository is the CLI Plugin Repo (CLIPR), a reference implementation of a repo server. For information on how to run CLIPR or how to write your own, please see the CLIPR documentation here.

cli-plugin-repo's People

Contributors

a-b avatar abbyachau avatar acrmp avatar andrewlunde avatar arthurhlt avatar ccjaimes avatar cdelashmutt-pivotal avatar csterwa avatar ctlong avatar drnic avatar happytobi avatar heyjcollins avatar ivanborislavovdimitrov avatar jberkhahn avatar jdgonzaleza avatar jenspinney avatar jinmeiliao avatar jtuchscherer avatar krishicks avatar krujos avatar mariash avatar micellius avatar pcf-event-alerts-cibot avatar sclevine avatar ssisil avatar thepeterstone avatar tjvman avatar vitreuz avatar wfernandes avatar xenophex avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

cli-plugin-repo's Issues

Plugin Repository

I see this PR approved but still not available in the catalog.

#374

Any update when that will be listed?

allow multiple versions of a plugin to coexist in the repo

we may need to allow the user to to able to select and install different versions of the plugin as the user may interact with different cloud environments, and sometimes we can not guarentee the backward compatibility. This can be done by having multiple plugin entries for different versions in repo-index.yml. But a better way might be having one entry for the plugin, and multiple sub-entries for differetn versions

We can force only one version can be installed to avoid command conflict.

To enable this, there will be corresponding changes on the cf cli side too. E.g

cf install-plugin PLUGIN-NAME or LOCAL-PATH/TO/PLUGIN [-r REPO_NAME] [-v VERSION]

Unable to install cfdev Plugin

Hello, when attempting to run the following command-

cf install-plugin cfdev

the following error pops-

$ cf install-plugin cfdev
Searching CF-Community for plugin cfdev...
Plugin cfdev 0.0.18 found in: CF-Community
Attention: Plugins are binaries written by potentially untrusted authors.
Install and use plugins at your own risk.
Do you want to install the plugin cfdev? [yN]: y
Starting download of plugin binary from repository CF-Community...
Get "https://d3p1cc0zb2wjno.cloudfront.net/cfdev/cfdev-v0.0.18-rc.36-darwin": dial tcp: lookup d3p1cc0zb2wjno.cloudfront.net: no such host
FAILED

plugins.cloudfoundry.org fell back to very old version?

Hello,

it seems the information on https://plugins.cloudfoundry.org/ does not reflect https://github.com/cloudfoundry/cli-plugin-repo/commits/main/

E.g. metric-registrar v.1.3.1 - but it should be already 1.4.3.
For several other plugins too - in fact all entries on current plugins.cloudfoundry.org page are older than year 2022.

You can even verify with web archive: https://web.archive.org/web/20231118165550/https://plugins.cloudfoundry.org/

Is there anything wrong?

Thanks.

Binaries

I’m trying to submit my plugin into CF plugins repository but I’m having trouble with the instructions specifically the repo-index.yml and the binaries. I’m unsure how to produce a binary with a url and checksum as well as how to even cross-compile it. Here is a link to my plugin https://github.com/ezra-lieblich/safe-scale https://github.com/ezra-lieblich/safe-scale. I was wondering if maybe I was missing some folder or file that would help produce binaries.

feature request: allow CLIPR to be available to everyone

When I push the CLIPR app to my Cloud Foundry installation and add it as a plugin repository with "cf add-plugin-repo", only I can see the repo and install the plugins defined in it, other users cannot (even though they can access to the CLIPR app URL itself)

Would it be possible to make CLIPR available to anyone in a CF installation to make the plugins globally accessible to everyone with access to that CF?

cf uninstall-plugin [name] runs the plugin before actually uninstalling

cf version 6.33.1+c77e55743.2017-12-15 on a unix (mac) machine

While developing a plugin - I noticed during a plugin uninstall the plugin will actually run before uninstalling. I tried this against other established plugins and found the same result.

This doesn't seem like a wanted result for the uninstall process.

Let me know if you need any more details.

Can't list community plugins - Invalid json data from 'CF-Community'

Hello, I get the error
Invalid json data from 'CF-Community' - invalid character '<' looking for beginning of value
when I try to list community plugins.

Steps to reproduce:

$ cf -v
cf version 8.7.4+db5d612.2023-10-20

$ cf add-plugin-repo CF-Community https://plugins.cloudfoundry.org
https://plugins.cloudfoundry.org added as CF-Community

$ cf list-plugin-repos
OK

Repo Name      URL
CF-Community   https://plugins.cloudfoundry.org

$ cf repo-plugins
Getting plugins from all repositories ...

Logged errors:
Invalid json data from 'CF-Community' - invalid character '<' looking for beginning of value

Windows binary signing instructions needed

We’re finding government users are unable to use unsigned Windows binaries on locked-down laptops. When a binary is signed, it’s easier for admins in similarly locked-down environments to whitelist either by individual signature or by publisher.

The CF CLI itself is signed, but the plugins generally aren’t. I'd like to see instructions for signing Windows binaries added to the section of the docs about cross-compiling binaries.

For reference, here's how the CLI does it. Reference this Slack discussion.

Best way to debug plugin

Hey I'm wondering what's the best way to debug plugin? I can debug GO locally but have no idea to do that with plugin? Cloud you shed some light on this?

Thanks
David

Remove cf recycle because of major bug

The current version of the cf recycle plugin has a major bug which can cause downtimes.
So its not safe to it till this issue is fixed.
As an alternative there seems to be a fork of the plugin which fixes this issue.

Maybe the comcast plugin should be removed and the fork added.

For more details see Comcast/cf-recycle-plugin#3

thx

plugins.cloudfoundry.org shouldn't be available via plain http

As I understand the plugin install process (and I'm pretty new to it), the fact that plugins.cloudfoundry.org is available via plain HTTP (and that the CLI defaults to the non-HTTPS version) introduces a vulnerability that an attacker can cause the cli to install a malicious binary when a user attempts to install a plugin.

Assuming the above is true, in order to protect users, the repo shouldn't be available via plain HTTP when run on the internet (having it as an option for intranet deployments may be reasonable).

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.