feat(manager/asdf): Add even more ASDF plugins (yq/jq/gh/sbt/...)

[MPV]

Tell us more.

Could we please also add more ASDF plugins?

For example:

• yq
• jq
• github-cli
• sbt

As previously done in PRs like:

• feat(manager/asdf): add additional asdf supported tools #18612
• feat(manager/asdf): add steampipe #24146
• feat(asdf): Add support for more ASDF plugins #21942
• feat(manager/asdf): add ecspresso #22021
• feat(manager/asdf): Add maestro, detekt and ktlint #21999
• feat(managers/asdf): Add poetry support in asdf manager #21765
• feat(asdf): Support sops asdf plugin #21306

[rarkins]

PRs welcome

[MPV]

Would it be an option to change how the ASDF manager works, so all manual PRs (like above) aren't required?

For example by making use of something like:

1. ASDF community plugins directory

See:

• https://github.com/asdf-vm/asdf-plugins

As they describe it:

Plugins listed here should be stable and actively maintained. If you have issues with a specific plugin please raise them on the plugin repository first. If a deprecated plugin is listed here, please let us know and create a PR to add the most used alternative.

2. asdf-plugin-manager

See:

• https://github.com/asdf-community/asdf-plugin-manager
• Add support for `asdf-plugin-manager` #24667

As they describe it:

Why?

Asdf is a great universal version manager. However, it lacks a secure and declarative method to manage its plugins. For example, you cannot pin a specific asdf plugin version, which means you will be easily hacked if one of the asdf plugins you use is compromised!

asdf-vm/asdf#1577, but no solution has been proposed in asdf upstream yet! (Last check: Aug 2023)

Hence, asdf-plugin-manager fills the gap to manage asdf plugins securely and declaratively via .plugin-versions file.

[rarkins]

We could potentially have an asdf-plugins datasource which matches the plug-in name to that public repo and then proxies the lookup to the applicable datasource (Eg github-tags)

[rarkins]

Alternatively we could use it as another static data source

[MPV]

Or we could read from the .plugins-versions file (if it exists), and use those repos and revisions for retrieving dependencies, as per:

• Add support for `asdf-plugin-manager` #24667

Benefit of this approach include:

• reproducibility.
• safety (only trusted/allowlisted revisions of repos would be used).

Though as asdf-plugin-manager isn't built-in to asdf yet, a fallback method will be needed too (possibly the plugins repo).