Package Registries

[lsjroberts]

[TODO: placeholder, to be expanded)

1. Can a registry be a static file server?
   a. Ownership transference key generated as a combination of package and an entered password
   b. Publishing through ssh keys associated with the files on the server?
   c. How would they upload? Don't want to allow file access to randoms.

2. If not static, a docker container.
   a. What would be the upgrade path for a deployed registry? Without wiping out existing published packages.

3. Auth method?
   a. Portier
   b. Certificates