Skip to content

Use the public Nexus SDK without repository credentials - #14

Closed
Marketen wants to merge 5 commits into
mainfrom
docs/public-sdk-cleanup
Closed

Marketen wants to merge 5 commits into
mainfrom
docs/public-sdk-cleanup

Conversation

@Marketen

@Marketen Marketen commented Sep 2, 2026

Copy link
Copy Markdown
Contributor

Summary

  • keep the package identity as Nexus Local Proxy for DAppNode
  • rewrite its README around connecting DAppNode applications and checking verification
  • remove internal attestation rollout and current-pin documentation
  • remove the private SDK token from Docker Compose and GitHub Actions
  • fetch the SDK from a pinned public commit without credentials
  • use the patched Go 1.26.8 builder and include the SDK Apache-2.0 license in the runtime image

Dependency

This draft currently targets SDK commit d49c902f480ae0db34e2c0621b0ef13384e992f0 from dappnode/dappnode-nexus-sdk#6. Keep it as a draft until that PR is merged and the SDK repository is public. Before merging this PR, pin UPSTREAM_VERSION to the final commit on SDK main if the SDK PR is squash-merged, then rerun the full image build.

The current Build test failure is expected: the container performs an unauthenticated fetch while the SDK repository is still private.

The removed technical README has been preserved outside the repository for maintainers.

Validation

  • docker compose config --quiet
  • package metadata JSON validation
  • CodeQL
  • full image build deferred until the SDK repository is public

@Marketen Marketen changed the title Present Nexus as a privacy layer and use the public SDK Use the public Nexus SDK without repository credentials Sep 2, 2026
Marketen added a commit that referenced this pull request Sep 9, 2026
Replaces the hand-maintained SHA with the pattern every other Dappnode package
already uses: upstreamVersion names an upstream release, and the bump bot opens
the PR. Hermes tracks NousResearch/hermes-agent exactly this way.

The SDK had nothing to point at, which is the only reason a SHA was there in
the first place; dappnode/dappnode-nexus-sdk#11 makes it cut a release on every
merge to main.

- upstreamVersion becomes v0.1.0 and the Dockerfile takes a release tag,
  validating the shape and fetching refs/tags/.
- auto_check.yml calls dappnode/workflows bump-upstream, same as Hermes, so a
  new SDK release arrives as a PR rather than someone noticing.
- NEXUS_SDK_TOKEN goes: the SDK is public, so the secret mount in the
  Dockerfile, the compose secrets block and both workflow env entries were all
  dead. Supersedes #14.
- The release job gains needs: build-test. It had none, so a failing build test
  did not stop a publish. Open since the 24 August notes.

Verified: the tag shape check accepts v0.1.0 and rejects a SHA, a bare branch
name and a two-part version; fetching refs/tags/ resolves against a repository
that has tags; manifest and compose pass dappmanager validation. The image
itself cannot build until the first SDK release exists.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
@Marketen Marketen closed this Sep 10, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant