Whether namespace/package removal should be allowed in Warg protocol?

[oovm]

I mistakenly created a namespace in wa.dev, and I realized I was in dangerous territory when I tried to delete it.

Is it legal to delete a namespace which means deleting all packages within it? Will it accidentally break compatibility?

We may need to specify a deletion rule, such as

• Can be removed if and only if all versions in the package are not referenced by any other public library.
• Can be removed when all dependencies can be deleted and have operation permissions
• A namespace can only be deleted when all packages in the namespace are allowed to be deleted.

graph TB
1[Can the namespace be deleted?] -- Yes --> 2[Can all packages in the namespace be deleted?]
1[Can the namespace be deleted?] -- No --> 3[Cannot delete namespace]
2[Can all packages in the namespace be deleted?] -- Yes --> 4[Can all versions in the packages be deleted?]
2[Can all packages in the namespace be deleted?] -- No --> 5[Cannot delete all packages]
4[Can all versions in the packages be deleted?] -- Yes --> 6[Are the versions not referenced by any public libraries?]
4[Can all versions in the packages be deleted?] -- No --> 7[Cannot delete all versions]
6[Are the versions not referenced by any public libraries?] -- Yes --> 8[All can be deleted]
6[Are the versions not referenced by any public libraries?] -- No --> 9[Cannot delete the versions]

Loading

There are also many complex situations, such as whether owners agree to delete.

---

The need for deletion exists because sometimes accidental typos create unnecessary package names.

Accidental release of private information can be solved with yank

[calvinrp]

All really great questions. We have been discussing and asking the same questions. And thinking along the same lines. Work in progress on figuring this out.

[calvinrp]

I think we have a "reasonable" path on the Warg protocol with respect to renaming packages by copying the log and reporting warnings when fetching the old name. Deleting a package might be yanking all releases and fetch warnings. Fetch warnings were recently added to Warg API.

On wa.dev, each namespace is its own independent Warg registry. So in some sense, that is out of the Warg protocol itself. You use Warg federation to access different namespaces.

All the choices have trade-offs. We plan on supporting deleting and renaming but trying to do it in a way that minimizes breaking dependencies. As it stands right now, due to tooling considerations, it isn't easy to publish packages that directly import other packages. But that will be changing very soon.

[oovm]

Add some notes:

The function name is actually built into the wasm file, which means rename != copy + delete

Renaming can be a very difficult requirement.

[lann]

Just a note: issues specific to wa.dev should probably go in https://github.com/JAFLabs/wa.dev-issues. This repository is just for issues related to the warg protocol, client, and reference server implementation.

[lann]

An important consideration in any discussion about "allowing" deletion is that a registry maintainer might be legally required to remove package content due to some copyright, trademark, or other local jurisdictional requirement. I think any design has to have some level of resilience to arbitrary removal of content.