OpenCSW Catalog Release Upload

TODO

- Document the security aspects

# OpenCSW Upload Application

This application is used to upload packages to be distributed by OpenCSW. The application is supposed to be used by both humans doing uploads manually and by tools. HTML is used as the main hypermedia to communicate interactions.

An informal summary of the process:

- A new upload is created. The upload is a long-lived resource so it will get its own URI.
- A set of files with metadata is attached to the upload.
- If wanted the maintainer can run the checkpkg tool to find any issues with the packages to be uploaded.
- The upload is frozen and sent to the release manager for approval.

## General Constraints

It is expected that any user agent:

- Includes any hidden elements in a form. Only inputs that the user agent is expected to fill out are documented.
- Uses the method specified in a form.

# Pages

## Catalog Release Summary

A document listing all packages and the architecture/release combination they support. Should include a "Create Upload" form. It should be possible to use content negotiation get the data as an Atom feed.

## Upload Summary

A document that shows the current state of the upload. It should include the "Add File", "checkpkg report", "delete upload", "submit upload" forms.

There must be a span element with the id upload-state. Currently available upload states:

- unsubmitted
- submitted

The user agent should not use the value for anything in particular but instead look at the available forms when presenting options to the user. The field is there as information for humans.

## Checkpkg Report

An informal report showing any errors/warnings detected from the checkpkg tool.

TODO: The format of the checkpkg report might be formalized in its own media type later on but right now that doesn't exist.

TODO: It would be nice to be able to select the format of this report. For tools it would be useful with a plain text version that they can show to the user directly. As it is now there's no need for any links from this page so the media doesn't need a way to represent links.

# Forms

## "Create Upload" Form

Name: create-upload

### Inputs

maintainer-id
  The OpenCSW id of the person that created the upload.

## "Add File" Form

Name: add-file

### Inputs

file-name
  The name of the physical file.
md5
  The MD5 checksum of the file.
signature
  The PGP signature of the file. It is expected that the maintainer uses the PGP key that's associated with the maintainer.

## "checkpkg Report" Form

## "Submit Upload" Form

Once this form is submitted the upload will be frozen and will be available for publishing if it passes the release manager.

## "Delete Upload" Form

Submit this form to remove the upload.

# Definitions of words and phrases

Package

  A System V package. Solaris use this package format as its native package format. Some packages contain architecture and/or Solaris release specific binaries while others can be installed across all architectures and Solaris releases.

  A package file is usually named "pkg" if it is to be used by the native Solaris tools, or "pkg.gz" when it's distributed and handled by the OpenCSW tools.

Catalog
  A catalog is a index of all packages available for a specific architecture and Solaris release.
Catalog Release
  A catalog release is a set of catalogs which covers all architectures and Solaris releases that the specific catalog release support.
Maintainer
  A person that create packages and performs uploads to the repository
Release Manager
  A person that checks/inspects the released packages and publishes them.
checkpkg
  A tool created by OpenCSW that automates the process of checking if a package is compliant with the current OpenCSW policies. Used by both maintainers and release managers.
Upload
  An upload consists of a set of pkg files with meta data that a maintainer want to publish.