Zoidberg

Zoidberg is the official package registry for Zoi. It is a Git repository that contains the definitions for all the official packages.

• Primary: GitLab
• Mirrors: GitHub, Codeberg

Installing a PackageCopy Anchor Link

To use Zoidberg packages, you must first have Zoi installed. Zoidberg is the default registry for Zoi.

1. Sync the RegistryCopy Anchor Link

Before installing any packages, ensure your local database is up to date:

zoi sync

2. Install a PackageCopy Anchor Link

You can install packages using the @repo/name syntax. For example, to install hello from the zillowe repository:

zoi install @zillowe/hello

Using MirrorsCopy Anchor Link

If you wish to use one of the official Zoidberg mirrors (GitHub or Codeberg), you can change your active registry by setting it to the mirror's git URL:

# Set to GitHub mirror
zoi sync set https://github.com/zillowe/zoidberg.git

# Set to Codeberg mirror
zoi sync set https://codeberg.org/zillowe/zoidberg.git

# Revert to the built-in set registry
zoi sync set default

After changing the mirror, run zoi sync to update your local metadata.

Security & PGP KeysCopy Anchor Link

If you installed Zoi from an unofficial source you'll need to add PGP keys of the maintainers of Zoidberg to be able to sync packages safely, if you installed Zoi from an official source you won't need to do that because it's backed into Zoi:

zoi pgp add https://zillowe.pages.dev/keys/zillowe-main.asc
zoi pgp add https://zillowez.rf.gd/assets/zillowez.asc

Contributing & GuidelinesCopy Anchor Link

We welcome contributions to Zoidberg! To maintain high quality and consistency, all submissions must follow the official Zoidberg Packaging Guidelines.

These guidelines cover naming standards, versioning, and license requirements. Manual pages must be staged with zman() so they are available via zoi man (see the Lua API reference).

Build pipeline, deltas & retentionCopy Anchor Link

Each merged change to a .pkg.lua file is built per platform by the registry pipeline. For every platform build the pipeline publishes:

• the .zpa archive plus .hash, .size, .files and .sig sidecars,
• the .zsa source bundle plus its sidecars,
• a .zdelta patch against the previous published version plus .hash, .size and .sig sidecars (skipped when no previous version exists).

Deltas follow the {name}-{version}-{platform}.zdelta naming from repo.yaml and power bandwidth-efficient upgrades as described in Repositories.

Only the last three versions of each package are kept (plus the latest pointer). Older generic-package versions are pruned automatically on every platform.

Repository TiersCopy Anchor Link

Zoidberg organizes packages into tiers. These tiers help to indicate the stability and maintenance status of a package.

Note: Packages from community, test, and archive may carry higher risk. Zoi prints warnings where appropriate.

Packages from extra repo requires using the @extra/<package> format because its not active by default, to activate it:

zoi repo add extra

And now you can install packages from the extra repo like you would from core or main.

For details on how to use and manage repositories, see the Repositories guide.

Reporting Security IssuesCopy Anchor Link

We take the security of Zoidberg packages seriously. If you discover a vulnerability in a package, please report it by opening a Merge Request with a security advisory file.

1. Create an Advisory: Add a .sec.yaml file to the package directory.
2. Use Temporary ID: Name it ZSA-YYYY-TEMP.sec.yaml.
3. Submit MR: Open a Merge Request on GitLab.

For more details, see the Security Advisories guide.