42 Apps, 13 Web Extensions, No Backend
The old ownCloud marketplace had a backend. A database. A server. An admin interface. Infrastructure to maintain, dependencies to patch, and a single point of failure between a publisher and the people who wanted their app.
The new one has none of that.
marketplace.owncloud.com is live with (as of this publication) 42 apps, 324 releases, 36 publishers, and 8 categories, along with 13 web extensions (and growing!).
All with no backend, no database, and no server-side processing of any kind. The Git repository is the source of truth. The catalogue is static JSON. Publishing an app is a pull request.
How It Works
The marketplace is a static site backed by a public GitHub repository at github.com/owncloud/marketplace. Every app in the catalogue is a structured entry in that repository. Every release is versioned in Git. Every update goes through a PR.
To publish an app, you submit a pull request using the template at .github/pull_request_template.md. The review happens on GitHub. The merge lands the app in the catalogue. The static site regenerates. Done.
This is the same contribution model as everything else we’ve built under the OSPO: code goes through Git, review happens in the open, there is no hidden approval process or privileged backdoor. The marketplace is auditable the same way the software it distributes is auditable.
The security properties follow from the architecture. A backend-free static site has a dramatically smaller attack surface than a traditional app store. No server to compromise. No database to exfiltrate. No session tokens to steal.
Two Platforms, One Catalogue
The marketplace covers both platforms. The Apps section lists extensions for ownCloud Classic — 42 apps spanning:
- tools,
- productivity,
- multimedia,
- files,
- integration,
- security,
- collaboration, and
The Web Extensions section is where oCIS extensions live— including everything from our internal AI sprint this week:
- Document Summary Extension
- Version Changelog Extension
- Image Alt Text Generator
- Chat-with-File Extension
All discoverable by any oCIS administrator looking to extend their deployment.
What’s in the Catalogue
42 apps across 8 categories. A sample:
- Security: E2EE File Sharing (client-side AES/RSA encryption), Duo Two-Factor Provider, Checksum
- Collaboration: FederatedGroups (cross-instance group sharing via SCIM, built for SURF), Carnet
- Files: Extract (archive unpacking — zip, rar, tar, 7z, bzip2), OPDS Catalog, Reader (ePub/PDF/CBZ)
- Tools: GpxEdit, Blood Pressure Log, 3D File Viewer, Bookmarks
36 publishers ranging from individual contributors to organisations like epiKshare GmbH, Afterlogic Corp., and ownCloud itself.
Publishing Is a PR
Fork, fill in the template, submit the PR. The template is at github.com/owncloud/marketplace/blob/main/.github/pull_request_template.md. Review happens on GitHub, in public, with a permanent record.
Why Architecture Is a Political Statement
A marketplace with a proprietary backend is a marketplace where the operator decides who publishes — sometimes with undocumented approval processes and no permanent record of decisions.
A marketplace where the repository is the catalogue and the PR is the submission process is a different kind of institution. The rules are the contribution guidelines. The review is the PR review. The record is the git log. We can still reject apps that don’t meet quality standards — but the criteria are public and the decisions are visible.
This is what it means to run a marketplace as an OSPO, not as a product team. The governance model extends to the distribution channel.
Links:
- marketplace.owncloud.com
- github.com/owncloud/marketplace
- ownCloud OSPO:
- moc.skrowetik@opso
- kiteworks.com/opensource
