Espressif component manager and registry

[beriberikix]

Are there plans to publish to the new Component Registry from Espressif, as documented here?

[UncleRus]

The documentation you linked to is well known and contains only a description of the component manifest, but nothing about registration in the registry.

We have repeatedly contacted Espressif about publishing components in their registry, but:

1. Currently, Espressif does not allow third parties to register their components in the registry.
2. Espressif is unable to ensure the security of the registry nor the legal basis.

[igrr]

Hi @UncleRus, could you please explain the 2nd point in more detail? If there are any concerns about the security or the legal aspects of the registry I'd like to address them. Is that related to the mention of kik/leftpad in this comment?

(On the 1st point, I'm also checking if we can open the registry access for esp-idf-lib project ahead of the public availability.)

[trombik]

@igrr i guess @UncleRus has his concerns. here is mine.

yes, the kik and leftpad debacles are my concerns. even worse, platformio did worse in its so-called registry (i stopped using platformio for serious projects, it might be better now. but i don't know). anyone can upload their work, or even a fork, just because they want to use it in platformio, but the author doesn't want to get involved in the fuss. the registry might be the largest in the world, but it is very hard to confirm its authenticity. you, as a vendor, might want more people to join, and lower the hurdle. but, as a user, I don't want to use random libraries from unknown sources (i'm referring authors, rather than URLs, or source repositories). Arduino probably has similar issues, but I don't know because I don't use it.

you might have been doing already, but you should do risk assessment in the project. as espressif has been demonstrating how serious it is in security, i am sure it will do the same in the component registry.

I've just got a trial account for my own project. I'll explore the component registry and give you my feedback.

[beriberikix]

I appreciate the quick response! I just learned about the registry this week from their online event, my apologies. They mentioned thy are planning on opening it up to third parties soon - maybe @igrr might know more?

[kumekay]

@beriberikix @UncleRus Last week we opened the registry for 3rd party contributors in preview-mode. If you are interested feel free to fill the form https://components.espressif.com/preview/

[trombik]

see also: espressif/idf-component-manager#4

[lukilukeskywalker]

Hi!
I am wondering if there has been any progress on this? Having this set of components in the esp idf component registry would facilitate the management of the components themselves.
Also I have been thinking that separating each of the components in it's own git repository, would facilitate the integration of the components in the users projects. you could join all the components with the actual structure with submodules, each of the folders pointing to it's own repository.
This way, we wouldn't need to download the whole repository with components we might not need, and we would be able to integrate the components inside the project with idf.py add-dependency ssh:git@[...] as stated in this doc (page 7)

[lukilukeskywalker]

Oh, my bad, just saw you can specify the path to a component inside a github repository inside the idf_component.yml with
UncleRus/i2cdev:
git: https://github.com/UncleRus/esp-idf-lib.git
path: components/i2cdev

[trombik]

I'm not so active but have been following the development of idf-component. there have been many improvements but i do not consider they are stable. the migration to multiple repositories involves many tasks you, as a user, have never imagined.