- Go 80.2%
- Astro 11.9%
- Shell 4.9%
- Just 1.2%
- TypeScript 1%
- Other 0.8%
FOSS Extensions Store
License: AGPL-3.0 Language: Go Status: MVP
📄 Pitch (NLnet) · 🗺️ Roadmap · 🔒 Threat model · 🏗️ Architecture · 📸 Screenshots
An open-source browser extension store — think F-Droid for Chrome extensions. Developers register their existing Git repo; we clone, scan, and build every tagged release from source, then publish the artifact alongside a transparent scan report. No central gatekeeping, no opaque review.
Status: MVP complete. just demo produces a working end-to-end stack. Not yet ready for production end-users — see roadmap.
Why
- Transparency. Every extension ships with a full scan report: declared permissions, dependency audit, static-analysis findings — all publicly visible.
- Reproducibility. Artifacts are built deterministically from a specific Git commit. The SHA-256 is independently verifiable.
- No vendor gatekeeping. Licensed AGPL-3.0. The store cannot be quietly captured, monetised, or shut down by a single vendor.
Run the demo
Requires Docker or Podman with compose support, plus git.
just demo
# → http://localhost:4321
Initialises two demo extensions, starts Postgres + API + frontend, runs the ingestion pipeline, and prints the URL. First run: ~3–5 minutes (image builds). Subsequent runs: ~30 seconds.
just demo-down # stop and remove the database
rm -rf var/ # full reset (also removes demo repos)
just demo # re-run from scratch
See deploy/README.md for the full compose service breakdown.
Build
Requires Go 1.23+ and just.
just build # compile all five binaries into ./bin/
just test # run test suite
just vet # go vet
just fmt # gofmt
Architecture
Five Go binaries + an Astro frontend, all communicating through PostgreSQL and
a shared artifact filesystem. Extension metadata lives in a separate
registry repo — the backend tracks it continuously via git fetch,
not a submodule.
See docs/ARCHITECTURE.md for the full design, including
the two-tier runtime model (worker vs. API) and the data flow diagram.
Configuration
| Variable | Default | Description |
|---|---|---|
FES_DATABASE_URL |
— | Postgres DSN, e.g. postgres://user:pass@localhost/fes?sslmode=disable |
FES_REGISTRY_URL |
— | Git URL of the registry repo (cloned/fetched on each poll cycle) |
FES_REGISTRY_PATH |
— | Raw directory path to the registry; no git ops (for local dev/tests) |
FES_REGISTRY_CACHE |
./var/registry |
Local clone destination when using FES_REGISTRY_URL |
FES_ARTIFACTS_ROOT |
./var/artifacts |
Where built extension artifacts are stored |
FES_ALLOWED_ORIGINS |
http://localhost:4321 |
Comma-separated CORS origins for POST /api/reports |
FES_LOG_FORMAT |
text | Set to json for structured JSON logs |
FES_PUBLIC_API_BASE |
http://localhost:8080 |
API base URL baked into the Astro build |
See .env.example for the values used by the Docker Compose demo.
See internal/api/README.md for the full API endpoint reference.
Adding an extension to the store
Extensions are submitted to the separate
registry repository
by opening a PR that adds one YAML file. See CONTRIBUTING.md
for the full workflow and consent requirements.
Documentation
| Doc | Purpose |
|---|---|
docs/PITCH.md |
One-page grant application summary (NLnet format) |
docs/THREAT_MODEL.md |
Adversary analysis and honest scanner limitations |
docs/ROADMAP.md |
Phase 1 (done), Phase 2 (post-grant), Phase 3+ |
docs/ARCHITECTURE.md |
System design, data flow, component descriptions |
docs/HOSTING.md |
Single-VPS to multi-tier scaling guide |
docs/SCREENSHOTS/ |
Screenshots from the live demo |
Contributing
See CONTRIBUTING.md for how to add an extension, build locally, and submit code PRs.
See SECURITY.md for the responsible disclosure policy.
License
AGPL-3.0-or-later. See LICENSE.