Hello here, AdaCore just announced the 4th edition of the Crate of the Year Awards . No need to register, winning crates will be selected from all the crates in the Alire ecosystem.
I am opening this thread as a place for everyone to discuss which crate they think would be a good candidate or even promote their crate.
Have fun and happy hacking!
Does adding a crate to Alire still require a Microsoft account? I remember that stopped me from entering last year. If it does, I guess I should start bugging someone for help already.
There should have been automatic upload support in Alire like in sourceforge. No way I could submit updates of 20+ projects manually. I have no idea why setting up an SFTP server is such an issue.
Did you try the instructions for using a different remote host? alire/doc/publishing.md at de9e84f824a36d342e15fc5f1b589ea7f099960f · alire-project/alire · GitHub
The current main branch as of today lists the trusted remote hosts as:
Community_Trusted_Sites : constant String :=
"bitbucket.org"
& " github.com"
& " gitlab.com"
& " savannah.gnu.org"
& " savannah.nongnu.org"
& " sf.net";
I’m not an alire expert, but maybe something you could look into and see if it meets your needs?
Note that github doesn’t require a Microsoft account even though it is currently owned by Microsoft. I don’t have a Microsoft account at home and I use github. Work makes me use one there, but I don’t (actually can’t) use it at home.
I wasn’t aware of this. I appreciate the help, I’ll look into it.
A GitHub account is a Microsoft account.
- The remote host must be one of a few trusted major open-source sites.
This requirement is motivated by vulnerabilities identified with SHA1,
whose migration to a stronger hash is [not yet complete]
(https://git-scm.com/docs/hash-function-transition/) ingit.
alrwill inform you if your host is not supported. Please contact us if
you think a site should be allowed. The complete list can be consulted by
runningalr publish --trusted-sites.
I wonder if I can have my personal website added to this list, since the justification is so flimsy. I’ll bug them about that to spare myself the trouble of making an account somewhere.
That’s only for the Git origins:
origins.git.trusted_sites[String][Default:bitbucket.org github.com gitlab.com savannah.gnu.org savannah.nongnu.org sf.net]: Space-separated list of trusted sites for Git origins, used by ‘alr index –check’ and ‘alr publish –for-private-index’. If set to ‘…’, all origins are trusted. Note that this does not have any effect when using ‘alr publish’ for submissions to the community index (which only permits the default list).
For submitting the crate to the community index, you still need a GitHub account to make the pull request.
I guess the answer would be no. As far as I know, the reason to have a list of trusted sites for the Git origin is to avoid any problem with people taking control of the site and providing a Git content with the same commit Id but malevolent source code. Note that the Git commit Id is SHA-1, so it is not a secure hash code nowadays. That’s the reason of trusting only sites administered by some organizations; individually administered sites are more vulnerable to possible attacks.
Note that if you use the archive origin, you can store the archive anywhere, because you provide a SHA-512, which is trustable.
hashes: mandatory string array for source archives. An array of “kind:digest” fields that specify a hash kind and its value. Kinds accepted are:sha512.
That doesn’t change anything regarding the crate publishing to the community index. You still need someone to do a pull request using a GitHub account.
As my github account is only a mirror of a part of my own forgejo site, I don’t see the point here (and I’m probably not the only one).
If someone has issues or does not want to use Github to submit to Alire, just ping me with the full Alire package and I will see if I can upload/PR it myself 
I could understand Verisimilitude, but I don’t get yet your point. You can store the crate anywhere as an archive and provide a SHA-512. Then you can use your existent GitHub account to open a pull request. Where is the friction then?
I only answered to the reason to limit to “trusted websites”.
Anyway, what ever you do or how you share your code, you need a github account in the end to push the MR, as alire’s index is on github. I don’t care myself as I already had one, but I understand some doesn’t want to.
OK, I understand now. But Cybersecurity many times has to do with reducing risks, not eliminating them, so I understand the Alire author’s decision on this.
Regarding people not wanting to open a GitHub account, that is respectable, but it is still not a problem to contribute crates, as other community members, like @Irvise above, are willing to act as maintainers of the crate on behalf of the author to perform the final publishing step. There are more cases of that mediation thanks to other people.
A bit orthogonal to the discussion here (as the conditions for the CotYA are what they are), but if someone is absolutely against using any GitHub infrastructure, they can still share their own index elsewhere. It reduces visibility but users can still work with Alire with just an extra step to add that index.
Friendly reminder that there are about 2 weeks till the end of the year!!! Make your submissions as soon as possible! 
Well, I waited too long again. Really, I started setting up my libraries for submission, but I don’t think I should bother to care if they’re going to continue insisting on GitHub for this. Besides, if I help someone put my code on Microsoft GitHub, rather than it ending up there without my control, that could be construed as me agreeing with Microsoft’s plagiarism machine that seeks to launder my copyright.
I’ll contribute myself if they ever fix this unacceptable mandate, or not at all.
Your code does not need to be hosted on GitHub; it could be anywhere. The only time you would need to interact with GitHub is to publish your release to the Alire community index, which just requires an Alire manifest to be submitted to the index in a PR.
Inspired by @OneWingedShark’s Ada to seedForth concept, I converted my SPARK postfix calculator in a tiny Forth-like VM in SPARK called anteforth.
It does things like prove the validity of jumps in IF/THEN/ELSE, ensures the word parser terminates, and catches when words, name, or instruction space gets exceeded. It also supports colon definitions!
There’s a few more things I want to add (e.g. loops and generalized fetch/store), so I’ll keep working on a few more things, but I had to make sure I submitted before the deadline. I’ve somehow managed to not work with a Forth before and do not any have any formal verification training, but it was really fun and I learned a whole bunch.
Someone reminded me that I forgot to share the results here ^^