{"id":17526488,"url":"https://github.com/coder/code-marketplace","last_synced_at":"2025-05-16T15:03:54.095Z","repository":{"id":61627574,"uuid":"535759652","full_name":"coder/code-marketplace","owner":"coder","description":"Open source extension marketplace for VS Code.","archived":false,"fork":false,"pushed_at":"2025-03-31T11:44:59.000Z","size":8045,"stargazers_count":263,"open_issues_count":20,"forks_count":28,"subscribers_count":9,"default_branch":"main","last_synced_at":"2025-04-12T14:19:36.770Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"agpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/coder.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2022-09-12T16:40:20.000Z","updated_at":"2025-04-09T02:42:54.000Z","dependencies_parsed_at":"2024-11-07T00:08:22.110Z","dependency_job_id":"1f700a70-50f7-4d23-8dc5-cd7a823485ef","html_url":"https://github.com/coder/code-marketplace","commit_stats":{"total_commits":116,"total_committers":9,"mean_commits":12.88888888888889,"dds":"0.22413793103448276","last_synced_commit":"3e808a63c6894102d1c6d879e54344225aa96efe"},"previous_names":[],"tags_count":12,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/coder%2Fcode-marketplace","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/coder%2Fcode-marketplace/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/coder%2Fcode-marketplace/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/coder%2Fcode-marketplace/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/coder","download_url":"https://codeload.github.com/coder/code-marketplace/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248578875,"owners_count":21127714,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-10-20T15:01:49.515Z","updated_at":"2025-05-16T15:03:54.081Z","avatar_url":"https://github.com/coder.png","language":"Go","readme":"# Code Extension Marketplace\n\nThe Code Extension Marketplace is an open-source alternative to the VS Code\nMarketplace for use in editors like\n[code-server](https://github.com/coder/code-server) or [VSCodium](https://github.com/VSCodium/vscodium).\n\nIt is maintained by [Coder](https://www.coder.com) and is used by our enterprise\ncustomers in regulated and security-conscious industries like banking, asset\nmanagement, military, and intelligence where they deploy Coder in an air-gapped\nnetwork and accessing an internet-hosted marketplace is not allowed.\n\nThis marketplace reads extensions from file storage and provides an API for\neditors to consume. It does not have a frontend or any mechanisms for extension\nauthors to add or update extensions in the marketplace.\n\n## Deployment\n\nThe marketplace is a single binary. Deployment involves running the binary,\npointing it to a directory of extensions, and exposing the binary's bound\naddress in some way.\n\n### Kubernetes\n\nIf deploying with Kubernetes see the [Helm directory](./helm) otherwise read on.\n\n### Getting the binary\n\nThe binary can be downloaded from GitHub releases. For example here is a way to\ndownload the latest release using `wget`. Replace `$os` and `$arch` with your\noperating system and architecture.\n\n```console\nwget https://github.com/coder/code-marketplace/releases/latest/download/code-marketplace-$os-$arch -O ./code-marketplace\nchmod +x ./code-marketplace\n```\n\n### Running the server\n\nThe marketplace server can be ran using the `server` sub-command.\n\n```console\n./code-marketplace server [flags]\n```\n\nRun `./code-marketplace --help` for a full list of options.\n\n### Local storage\n\nTo use a local directory for extension storage use the `--extensions-dir` flag.\n\n```console\n\n./code-marketplace [command] --extensions-dir ./extensions\n```\n\n### Artifactory storage\n\nIt is possible use Artifactory as a file store instead of local storage. For\nthis to work the `ARTIFACTORY_TOKEN` environment variable must be set.\n\n```console\nexport ARTIFACTORY_TOKEN=\"my-token\"\n./code-marketplace [command] --artifactory http://artifactory.server/artifactory --repo extensions\n```\n\nThe token will be used in the `Authorization` header with the value `Bearer\n\u003cTOKEN\u003e`.\n\n### Exposing the marketplace\n\nThe marketplace must be put behind TLS otherwise code-server will reject\nconnecting to the API. This could mean using a TLS-terminating reverse proxy\nlike NGINX or Caddy with your own domain and certificates or using a service\nlike Cloudflare.\n\nWhen hosting the marketplace behind a reverse proxy set either the `Forwarded`\nheader or both the `X-Forwarded-Host` and `X-Forwarded-Proto` headers. These\nheaders are used to generate absolute URLs to extension assets in API responses.\nOne way to test this is to make a query and check one of the URLs in the\nresponse:\n\n```console\ncurl 'https://example.com/api/extensionquery' -H 'Accept: application/json;api-version=3.0-preview.1' --compressed -H 'Content-Type: application/json' --data-raw '{\"filters\":[{\"criteria\":[{\"filterType\":8,\"value\":\"Microsoft.VisualStudio.Code\"}],\"pageSize\":1}],\"flags\":439}' | jq .results[0].extensions[0].versions[0].assetUri\n\"https://example.com/assets/vscodevim/vim/1.24.1\"\n```\n\nThe marketplace does not support being hosted behind a base path; it must be\nproxied at the root of your domain.\n\n### Health checks\n\nThe `/healthz` endpoint can be used to determine if the marketplace is ready to\nreceive requests.\n\n## Adding extensions\n\nExtensions can be added to the marketplace by file, directory, or web URL.\n\n```console\n./code-marketplace add extension.vsix [flags]\n./code-marketplace add extension-vsixs/ [flags]\n./code-marketplace add https://domain.tld/extension.vsix [flags]\n```\n\nIf the extension has dependencies or is in an extension pack those details will\nbe printed.  Extensions listed as dependencies must also be added but extensions\nin a pack are optional.\n\nIf an extension is open source you can get it from one of three locations:\n\n1. GitHub releases (if the extension publishes releases to GitHub).\n2. Open VSX (if the extension is published to Open VSX).\n3. Building from source.\n\nFor example to add the Python extension from Open VSX:\n\n```console\n./code-marketplace add https://open-vsx.org/api/ms-python/python/2022.14.0/file/ms-python.python-2022.14.0.vsix [flags]\n```\n\nOr the Vim extension from GitHub:\n\n```console\n./code-marketplace add https://github.com/VSCodeVim/Vim/releases/download/v1.24.1/vim-1.24.1.vsix [flags]\n```\n\n## Removing extensions\n\nExtensions can be removed from the marketplace by ID and version or `--all` to\nremove all versions.\n\n```console\n./code-marketplace remove ms-python.python@2022.14.0 [flags]\n./code-marketplace remove ms-python.python --all [flags]\n```\n\n## Scanning frequency and caching\n\nThe marketplace does not utilize a database. When an extension query is made,\nthe marketplace scans the local file system or queries Artifactory on demand to\nfind all the available extensions.\n\nHowever, for Artifactory in particular this can be slow, so this full list of\nextensions is cached in memory for a default of one minute and reused for any\nsubsequent requests that fall within that duration. This duration can be\nconfigured or disabled with `--list-cache-duration` and applies to both storage\nbackends.\n\nThis means that when you add or remove an extension, depending on when the last\nrequest was made, it can take a duration between zero and\n`--list-cache-duration` for the query response to reflect that change.\n\nArtifactory storage also uses a second in-memory cache for extension manifests,\nwhich are referenced in extension queries (for things like categories). This\ncache is initially populated with all available extension manifests on startup.\nExtensions added after the server is running are added to the cache on-demand\nthe next time extensions are scanned.\n\nThe manifest cache has no expiration and never evicts manifests because it was\nexpected that extensions are typically only ever added and individual extension\nversion manifests never change; however we would like to implement evicting\nmanifests of extensions that have been removed.\n\nWith local storage, manifests are read directly from the file system on\ndemand. Requests for other extension assets (such as icons) for both storage\nbackends have no cache and are read/proxied directly from the file system or\nArtifactory since they are not in the extension query hot path.\n\n## Usage in code-server\n\nYou can point code-server to your marketplace by setting the\n`EXTENSIONS_GALLERY` environment variable.\n\nThe value of this variable is a JSON blob that specifies the service URL, item\nURL, and resource URL template.\n\n- `serviceURL`: specifies the location of the API (`https://\u003cdomain\u003e/api`).\n- `itemURL`: the frontend for extensions which is currently just a mostly blank\n  page that says \"not supported\" (`https://\u003cdomain\u003e/item`)\n- `resourceURLTemplate`: used to download web extensions like Vim; code-server\n  itself will replace the `{publisher}`, `{name}`, `{version}`, and `{path}`\n  template variables so use them verbatim\n  (`https://\u003cdomain\u003e/files/{publisher}/{name}/{version}/{path}`).\n\nFor example (replace `\u003cdomain\u003e` with your marketplace's domain):\n\n```console\nexport EXTENSIONS_GALLERY='{\"serviceUrl\":\"https://\u003cdomain\u003e/api\", \"itemUrl\":\"https://\u003cdomain\u003e/item\", \"resourceUrlTemplate\": \"https://\u003cdomain\u003e/files/{publisher}/{name}/{version}/{path}\"}'\ncode-server\n```\n\nIf code-server reports content security policy errors ensure that the\nmarketplace is running behind an https URL.\n\n### Custom certificate authority\n\nIf you are using a custom certificate authority or a self-signed certificate and\nget errors like \"unable to verify the first certificate\", you may need to set\nthe [NODE_EXTRA_CA_CERTS](https://nodejs.org/api/cli.html#node_extra_ca_certsfile)\nenvironment variable for code-server to find your certificates bundle.\n\nMake sure your bundle contains the full certificate chain. This can be necessary\nbecause Node does not read system certificates by default and while VS Code has\ncode for reading them, it appears not to work or be enabled for the web version.\n\nSome so-called \"web\" extensions (like `vscodevim.vim`) are installed in the\nbrowser, and extension searches are also performed from the browser, so your\ncertificate bundle may also need to be installed on the client machine in\naddition to the remote machine.\n\n## Usage in VS Code \u0026 VSCodium\n\nAlthough not officially supported, you can follow the examples below to start\nusing code-marketplace with VS Code and VSCodium:\n\n- [VS Code](https://github.com/eclipse/openvsx/wiki/Using-Open-VSX-in-VS-Code)\n\n  Extension signing may have to be disabled in VS Code.\n\n- [VSCodium](https://github.com/VSCodium/vscodium/blob/master/docs/index.md#howto-switch-marketplace)\n\n  ```\n  export VSCODE_GALLERY_SERVICE_URL=\"https://\u003cdomain\u003e/api\n  export VSCODE_GALLERY_ITEM_URL=\"https://\u003cdomain\u003e/item\"\n  # Or set a product.json file in `~/.config/VSCodium/product.json`\n  codium\n  ```\n\n## Missing features\n\n- Recommended extensions.\n- Featured extensions.\n- Download counts.\n- Ratings.\n- Searching by popularity.\n- Published, released, and updated dates for extensions (for example this will\n  cause bogus release dates to show for versions).\n- Frontend for browsing available extensions.\n- Extension validation (only the marketplace owner can add extensions anyway).\n- Adding and updating extensions by extension authors.\n\n## Planned work\n\n- Bulk add from one Artifactory repository to another (or to itself).\n- Optional database to speed up queries.\n- Progress indicators when adding/removing extensions.\n","funding_links":[],"categories":["Go"],"sub_categories":[],"project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcoder%2Fcode-marketplace","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fcoder%2Fcode-marketplace","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcoder%2Fcode-marketplace/lists"}