Tool to help creating distributions of packages

.github/dependabot.yml

@@ -12,3 +12,10 @@ updates:
       elastic-apm:
         patterns:
           - "go.elastic.co/apm/*"
+  - package-ecosystem: "gomod"
+    directory: "/cmd/distribution"
+    schedule:
+      interval: "daily"
+    labels:
+      - automation
+    open-pull-requests-limit: 10

.gitignore

@@ -1,5 +1,6 @@
 .DS_Store
 package-registry
+cmd/distribution/distribution
 
 .idea
 *.iml

AGENTS.md

@@ -93,6 +93,25 @@ Test packages are stored in `testdata/package/` with various scenarios (e.g., `d
 - **Import grouping**: Elastic packages (`github.com/elastic`) grouped after third-party
 - Run `mage check` before committing to ensure formatting and licensing
 
+### Testing Assertions
+
+When using testify for test assertions:
+- Use **`require`** only for blocking assertions that would cause panics if they fail (e.g., nil checks before dereferencing)
+- Use **`assert`** for all other assertions so multiple checks can run in the same test
+- This approach provides better test failure visibility by showing all failing assertions at once
+
+Example:
+```go
+// Use require for blocking checks
+require.NotNil(t, result)           // Must pass or dereferencing will panic
+require.NoError(t, err)             // Must pass or result may be invalid
+
+// Use assert for validation checks
+assert.Equal(t, "expected", result.Name)
+assert.True(t, result.IsValid)
+assert.Len(t, result.Items, 3)
+```
+
 ### Package Structure
 
 Packages follow the [package-spec](https://github.com/elastic/package-spec) specification. Changes to package structure should be proposed to package-spec first.

cmd/distribution/GPG-KEY-elasticsearch

@@ -0,0 +1,31 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQENBFI3HsoBCADXDtbNJnxbPqB1vDNtCsqhe49vFYsZN9IOZsZXgp7aHjh6CJBD
+A+bGFOwyhbd7at35jQjWAw1O3cfYsKAmFy+Ar3LHCMkV3oZspJACTIgCrwnkic/9
+CUliQe324qvObU2QRtP4Fl0zWcfb/S8UYzWXWIFuJqMvE9MaRY1bwUBvzoqavLGZ
+j3SF1SPO+TB5QrHkrQHBsmX+Jda6d4Ylt8/t6CvMwgQNlrlzIO9WT+YN6zS+sqHd
+1YK/aY5qhoLNhp9G/HxhcSVCkLq8SStj1ZZ1S9juBPoXV1ZWNbxFNGwOh/NYGldD
+2kmBf3YgCqeLzHahsAEpvAm8TBa7Q9W21C8vABEBAAG0RUVsYXN0aWNzZWFyY2gg
+KEVsYXN0aWNzZWFyY2ggU2lnbmluZyBLZXkpIDxkZXZfb3BzQGVsYXN0aWNzZWFy
+Y2gub3JnPokBTgQTAQgAOAIbAwIXgBYhBEYJWsyFSFgsGiaZqdJ9ZmzYjkK0BQJk
+9vrZBQsJCAcDBRUKCQgLBRYCAwEAAh4FAAoJENJ9ZmzYjkK00hoH+wYXZKgVb3Wv
+4AA/+T1IAf7edwgajr58bEyqds6/4v6uZBneUaqahUqMXgLFRX5dBSrAS7bvE/jx
++BBQx+rpFGxSwvFegRevE1zAGVtpgkFQX0RpRcKSmksucSBxikR/dPn9XdJSEVa8
+vPcs11V+2E5tq3LEP14zJL4MkJKQF0VJl5UUmKLS7U2F/IB5aXry9UWdMTnwNntX
+kl2iDaViYF4MC6xTS24uLwND2St0Jvjt+xGEwbdBVvp+UZ/kG6IGkYM5eWGPuok/
+DHvjUdwTfyO9b5xGbqn5FJ3UFOwB/nOSFXHM8rsHRT/67gHcIl8YFqSQXpIkk9D3
+dCY+KieW0ue5AQ0EUjceygEIAOSVJc3DFuf3LsmUfGpUmnCqoUm76Eqqm8xynFEG
+ZpczTChkwARRtckcfa/sGv376j+jk0c0Q71Uv3MnMLPGF+w3bpu8fLiPeW/cntf1
+8uZ6DxJvHA/oaZZ6VPjwUGSeVydiPtZfTYsceO8Dxl3gpS6nHZ9Gsnfr/kcH9/11
+Ca73HBtmGVIkOI1mZKMbANO8cewY/i7fPxShu7B0Rb3jxVNGUuiRcfRiao0gWx0U
+ZGpvuHplt7loFX2cbsHFAp9WsjYEbSohb/Y0K4NkyFhL82MfbcsEwsXPhRTFgJWw
+s4vpuFg/kFFlnw0NNPVP1jNJLNCsMBMEpP1A7k6MRpylNnUAEQEAAYkBNgQYAQgA
+IAIbDBYhBEYJWsyFSFgsGiaZqdJ9ZmzYjkK0BQJk9vsHAAoJENJ9ZmzYjkK0hWsH
+/ArKtn12HM3+41zYo9qO4rTri7+IYTjSB/JDTOusZgZLd/HCp1xQo4SI2Eur3Rtx
+USMWK1LEeBzsjwDT9yVceYekrBEqUVyRMSVYj+UeZK2s4LbXm9b4jxXVtaivmkMA
+jtznndrD7kmm8ak+UsZplf6p6uZS9TZ9hjwoMmw5oMaS6TZkLT4KYGWeyzHJSUBX
+YikY6vssDQu4SJ07m1f4Hz81J39QOcHln5I5HTK8Rh/VUFcxNnGg9360g55wWpiF
+eUTeMyoXpOtffiUhiOtbRYsmSYC0D4Fd5yJnO3n1pwnVVVsM7RAC22rc5j/Dw8dR
+GIHikRcYWeXTYW7veewK5Ss=
+=ftS0
+-----END PGP PUBLIC KEY BLOCK-----

cmd/distribution/Makefile

@@ -0,0 +1 @@
+include ../../Makefile

cmd/distribution/README.md

@@ -0,0 +1,69 @@
+# Distribution Tool
+
+A utility for downloading packages from Elastic Package Registry (EPR).
+
+## Overview
+
+The distribution tool allows you to collect and download integration packages from an EPR instance based on configurable search queries. It supports filtering by package type, Kibana version, spec version, and other parameters.
+
+## Building
+
+```bash
+cd cmd/distribution
+go build
+```
+
+Or install directly:
+
+```bash
+go install github.com/elastic/package-registry/cmd/distribution@latest
+```
+
+## Usage
+
+```bash
+./distribution <config.yaml>
+```
+
+The tool requires a YAML configuration file that defines:
+- **address**: EPR endpoint to query (defaults to `https://epr.elastic.co`)
+- **queries**: Search parameters to filter packages
+- **matrix**: Parameter combinations to expand queries
+- **packages**: Specific packages to include by name and version
+- **actions**: Operations to perform (print, download, validate)
+
+See `minimal.yaml` and `lite-all.yaml` for example configurations.
+
+## Configuration Examples
+
+### Minimal Configuration
+```yaml
+address: https://epr.elastic.co
+queries:
+  - package: nginx
+actions:
+  - print: {}
+```
+
+### Download with Validation
+```yaml
+address: https://epr.elastic.co
+queries:
+  - type: integration
+    kibana.version: 8.0.0
+actions:
+  - download:
+      destination: ./packages
+      validate: true
+```
+
+## Actions
+
+- **print**: Output package names and versions to console
+- **download**: Download package ZIP files and signatures
+  - `destination`: Target directory for downloads
+  - `validate`: Verify package signatures using GPG
+
+## Dependencies
+
+Managed via Go modules. Run `go mod tidy` to update dependencies.