Replace loft-sh with Curity in the module path, app identifier and provider downloads

.github/workflows/dockerless.yaml

@@ -49,7 +49,7 @@ jobs:
       - name: Check licenses
         run: |
           go install github.com/google/go-licenses/v2@v2.0.1
-          go-licenses check ./... --ignore github.com/loft-sh/devpod
+          go-licenses check ./... --ignore github.com/curityio/devpod
 
   image:
     needs: check

.github/workflows/go-licenses-check.yaml

@@ -33,6 +33,6 @@ jobs:
       - name: Run go-licenses check
         # go.mod's toolchain directive makes `go` switch to a downloaded toolchain, so point
         # GOROOT at it; otherwise go-licenses doesn't recognize standard library packages
-        run: GOROOT="$(go env GOROOT)" go-licenses check ./... --ignore github.com/loft-sh/devpod
+        run: GOROOT="$(go env GOROOT)" go-licenses check ./... --ignore github.com/curityio/devpod
         env:
           GOPRIVATE: "github.com/loft-sh/*"

.github/workflows/go-licenses.yaml

@@ -37,11 +37,7 @@ jobs:
       - name: Run go-licenses
         # go.mod's toolchain directive makes `go` switch to a downloaded toolchain, so point
         # GOROOT at it; otherwise go-licenses doesn't recognize standard library packages
-        run: GOROOT="$(go env GOROOT)" go-licenses report ./... > docs/pages/licenses/devpod.mdx --template .github/licenses.tmpl --ignore github.com/loft-sh/devpod
-
-      - name: Point license links at this repository
-        # go-licenses builds the links from the Go module path, which is still github.com/loft-sh/devpod
-        run: sed -i 's#https://github.com/loft-sh/devpod/blob/HEAD/#https://github.com/curityio/devpod/blob/HEAD/#g' docs/pages/licenses/devpod.mdx
+        run: GOROOT="$(go env GOROOT)" go-licenses report ./... > docs/pages/licenses/devpod.mdx --template .github/licenses.tmpl --ignore github.com/curityio/devpod
 
       - name: Create pull request
         uses: peter-evans/create-pull-request@v5

.github/workflows/release.yaml

@@ -159,13 +159,13 @@ jobs:
       - name: Build Linux agents
         shell: bash
         run: |
-          LDFLAGS="-s -w -X github.com/loft-sh/devpod/pkg/version.version=v${{ needs.create-release.outputs.original_package_version }} -X github.com/loft-sh/devpod/pkg/devcontainer/crane.craneSigningKey=${{ secrets.CRANE_PRIVATE_KEY }}" ./hack/build-agents.sh
+          LDFLAGS="-s -w -X github.com/curityio/devpod/pkg/version.version=v${{ needs.create-release.outputs.original_package_version }} -X github.com/curityio/devpod/pkg/devcontainer/crane.craneSigningKey=${{ secrets.CRANE_PRIVATE_KEY }}" ./hack/build-agents.sh
 
       - name: Build Sidecar CLI
         if: matrix.settings.host != 'windows-latest'
         run: |
           BIN_NAME=devpod-cli-${{ matrix.settings.target }}
-          GOOS=${{ matrix.settings.os }} GOARCH=${{ matrix.settings.arch }} CGO_ENABLED=0 go build -ldflags "-s -w -X github.com/loft-sh/devpod/pkg/version.version="v${{ needs.create-release.outputs.original_package_version }}" -X github.com/loft-sh/devpod/pkg/devcontainer/crane.craneSigningKey="${{ secrets.CRANE_PRIVATE_KEY }}"" -o "test/$BIN_NAME"
+          GOOS=${{ matrix.settings.os }} GOARCH=${{ matrix.settings.arch }} CGO_ENABLED=0 go build -ldflags "-s -w -X github.com/curityio/devpod/pkg/version.version="v${{ needs.create-release.outputs.original_package_version }}" -X github.com/curityio/devpod/pkg/devcontainer/crane.craneSigningKey="${{ secrets.CRANE_PRIVATE_KEY }}"" -o "test/$BIN_NAME"
           cp "test/$BIN_NAME" "desktop/src-tauri/bin/$BIN_NAME"
           ls desktop/src-tauri/bin
 
@@ -177,7 +177,7 @@ jobs:
           set GOARCH=${{ matrix.settings.arch }}
           set BIN_NAME=devpod-cli-${{ matrix.settings.target }}.exe
 
-          go build -ldflags "-s -w -X github.com/loft-sh/devpod/pkg/version.version="v${{ needs.create-release.outputs.original_package_version }}"" -o "test\%BIN_NAME%"
+          go build -ldflags "-s -w -X github.com/curityio/devpod/pkg/version.version="v${{ needs.create-release.outputs.original_package_version }}"" -o "test\%BIN_NAME%"
 
           xcopy /F /Y "test\%BIN_NAME%" desktop\src-tauri\bin\*
 
@@ -423,7 +423,7 @@ jobs:
           export SHA256=$(sha256sum "${debPath}" | cut -f1 -d ' ')
           export DESKTOP_SHA256=$(sha256sum "${desktopPath}" | cut -f1 -d ' ')
           export META_SHA256=$(sha256sum "${metaPath}" | cut -f1 -d ' ')
-          envsubst < desktop/flatpak/sh.loft.devpod.tmpl > desktop/flatpak/sh.loft.devpod.yaml
+          envsubst < desktop/flatpak/io.curity.devpod.tmpl > desktop/flatpak/io.curity.devpod.yaml
 
   publish-updates:
     needs: [build-app, create-release]

AGENTS.md

@@ -61,9 +61,13 @@ cd src-tauri && cargo +stable check
 
 - **Pull requests go to `curityio/devpod` `main` only, never upstream.** The `upstream` remote is read-only
   reference.
-- **The Go module path is still `github.com/loft-sh/devpod`.** Imports were deliberately not renamed; don't
-  "fix" them. Likewise the desktop app identifier `sh.loft.devpod` is kept because it is tied to the `devpod://`
-  deep link scheme, the Flatpak id and existing installs.
+- **The Go module path is `github.com/curityio/devpod`** (renamed from upstream's `github.com/loft-sh/devpod`).
+- **The desktop app identifier is `io.curity.devpod`** (upstream's was `sh.loft.devpod`). Tauri names the app's
+  data directories after it, so `desktop/src-tauri/src/identifier_migration.rs` copies an existing install's
+  `sh.loft.devpod` directories on first start, and `desktop/src-tauri/windows/installer-hooks.nsh` moves the
+  Windows installer's registry key from `Software\loft` to `Software\Curity` (the `publisher`). Changing the
+  identifier or the publisher again needs the same care. It also appears in `custom_protocol.rs`, `Info.plist`,
+  the Flatpak manifest and `command.ts` (`FLATPAK_ID`).
 - **Dependencies are vendored.** Builds use `-mod=vendor`. After changing imports or `go.mod`, run
   `GOFLAGS=-mod=mod go mod tidy && go mod vendor` and commit `vendor/`.
 - **The agent is embedded in the CLI.** `hack/build-agents.sh` builds the Linux agents (amd64 and arm64, with the
@@ -81,12 +85,12 @@ cd src-tauri && cargo +stable check
   the binary, which also runs as the agent. Use `pkg/kubeclient`, which only registers core/v1 and rbac/v1; add a
   resource or group there if you need one. `go list -deps . | grep '^k8s.io/client-go/kubernetes'` must print
   nothing.
-- **Don't depend on `github.com/loft-sh` modules** (other than this module's own path). They are no longer
+- **Don't depend on `github.com/loft-sh` modules.** They are no longer
   maintained, and the ones DevPod used now live here: the logger is `pkg/log` (`log.Logger`, `log.Default`,
   `pkg/log/table`, `pkg/log/survey`), and the SSH server that runs in the container is `pkg/ssh/sshd`, a copy of
   `gliderlabs/ssh` with unix socket forwarding added. Check that a new dependency is maintained before adding
   it.
-- **`dockerless/` is a separate Go module** (`github.com/loft-sh/devpod/dockerless`), with its own `go.mod`, no
+- **`dockerless/` is a separate Go module** (`github.com/curityio/devpod/dockerless`), with its own `go.mod`, no
   `vendor/`, a newer Go and golangci-lint v2 (its `.golangci.yaml`). Commands run at the root don't see it: run
   them in `dockerless/`, with `GOOS=linux`. Its image is published from a `dockerless-v<version>` tag; DevPod pins
   the version in `pkg/devcontainer/single.go`, so a change to `dockerless/` needs a new tag and that pin bumped.

CHANGELOG.md

@@ -23,6 +23,18 @@ Add new entries to the top of the "Unreleased" section.
   navy. In dark mode the
   background is Curity's navy with a purple glow, and cards are translucent purple panels. The Curity logo is
   white in dark mode.
+- The Go module path is `github.com/curityio/devpod` instead of `github.com/loft-sh/devpod` (and
+  `github.com/curityio/devpod/dockerless` for `dockerless/`), so stack traces and `-ldflags -X` settings, such as
+  `github.com/curityio/devpod/pkg/version.version`, use the new path.
+- The desktop app's identifier is `io.curity.devpod` instead of `sh.loft.devpod` (and the Flatpak id), and its
+  Windows publisher is Curity. On first start, it copies its settings, providers, logs, CLI shims and webview
+  storage from the old `sh.loft.devpod` directories, which are kept so that a `PATH` pointing at the old CLI
+  shims on Windows still works. The Windows installer finds an installation made with the old identifier.
+- A provider given by its name alone (`devpod provider add <name>`) is downloaded from GitHub's
+  `curityio/devpod-provider-<name>` instead of `loft-sh/devpod-provider-<name>`, except for the providers that
+  only exist under `loft-sh` so far: `aws`, `azure`, `civo`, `digitalocean`, `dockerless`, `ecs`, `gcloud`,
+  `kubernetes`, `ssh` and `terraform`. `devpod provider list-available` lists those and the `devpod-provider-*`
+  repositories of `curityio` (it used to list only the first 30 repositories of `loft-sh`).
 
 ## v0.9.0 (2026-10-23)
 

TODO.md

@@ -10,14 +10,24 @@ The built-in and documented providers still live under the `loft-sh` GitHub orga
 - [ ] `devpod-provider-azure`
 - [ ] `devpod-provider-civo`
 - [ ] `devpod-provider-digitalocean`
+- [ ] `devpod-provider-dockerless`
+- [ ] `devpod-provider-ecs`
 - [ ] `devpod-provider-gcloud`
 - [ ] `devpod-provider-kubernetes`
 - [ ] `devpod-provider-ssh`
+- [ ] `devpod-provider-terraform`
 
 For each provider we keep: fork it to `curityio`, then update its references in this repository
 (provider sources, `providers/*/provider.yaml`, docs, desktop app and e2e tests).
 Providers we don't keep should be removed from the code and docs.
 
+A provider given by its name alone (`devpod provider add aws`) is downloaded from
+`curityio/devpod-provider-<name>`, except for the names in `LoftProviders` (`pkg/workspace/provider.go`), which
+are still downloaded from `loft-sh`. Remove each provider from that list as it's migrated, and remove the list
+(and the note about it in `docs/pages/managing-providers/add-provider.mdx`) once it's empty. Providers added
+before they were migrated keep their `loft-sh` repository as their source, so `devpod provider update` keeps
+downloading them from there until they are added again.
+
 ## Fix links to content that only exists upstream
 
 These links still point to `loft-sh/devpod` because the issues and releases they reference don't exist

cmd/agent/agent.go

@@ -3,13 +3,13 @@ package agent
 import (
 	"os"
 
-	"github.com/loft-sh/devpod/cmd/agent/container"
-	"github.com/loft-sh/devpod/cmd/agent/workspace"
-	"github.com/loft-sh/devpod/cmd/flags"
-	"github.com/loft-sh/devpod/pkg/client/clientimplementation"
-	"github.com/loft-sh/devpod/pkg/config"
-	"github.com/loft-sh/devpod/pkg/envfile"
-	"github.com/loft-sh/devpod/pkg/log"
+	"github.com/curityio/devpod/cmd/agent/container"
+	"github.com/curityio/devpod/cmd/agent/workspace"
+	"github.com/curityio/devpod/cmd/flags"
+	"github.com/curityio/devpod/pkg/client/clientimplementation"
+	"github.com/curityio/devpod/pkg/config"
+	"github.com/curityio/devpod/pkg/envfile"
+	"github.com/curityio/devpod/pkg/log"
 	"github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
 )

cmd/agent/container/container.go

@@ -1,7 +1,7 @@
 package container
 
 import (
-	"github.com/loft-sh/devpod/cmd/flags"
+	"github.com/curityio/devpod/cmd/flags"
 	"github.com/spf13/cobra"
 )
 

cmd/agent/container/credentials_server.go

@@ -9,16 +9,16 @@ import (
 	"os"
 	"strconv"
 
-	"github.com/loft-sh/devpod/cmd/flags"
-	"github.com/loft-sh/devpod/pkg/agent/tunnel"
-	"github.com/loft-sh/devpod/pkg/agent/tunnelserver"
-	"github.com/loft-sh/devpod/pkg/credentials"
-	"github.com/loft-sh/devpod/pkg/dockercredentials"
-	"github.com/loft-sh/devpod/pkg/gitcredentials"
-	"github.com/loft-sh/devpod/pkg/gitsshsigning"
-	"github.com/loft-sh/devpod/pkg/log"
-	"github.com/loft-sh/devpod/pkg/netstat"
-	portpkg "github.com/loft-sh/devpod/pkg/port"
+	"github.com/curityio/devpod/cmd/flags"
+	"github.com/curityio/devpod/pkg/agent/tunnel"
+	"github.com/curityio/devpod/pkg/agent/tunnelserver"
+	"github.com/curityio/devpod/pkg/credentials"
+	"github.com/curityio/devpod/pkg/dockercredentials"
+	"github.com/curityio/devpod/pkg/gitcredentials"
+	"github.com/curityio/devpod/pkg/gitsshsigning"
+	"github.com/curityio/devpod/pkg/log"
+	"github.com/curityio/devpod/pkg/netstat"
+	portpkg "github.com/curityio/devpod/pkg/port"
 	"github.com/spf13/cobra"
 )
 

cmd/agent/container/daemon.go

@@ -9,9 +9,9 @@ import (
 	"syscall"
 	"time"
 
-	"github.com/loft-sh/devpod/pkg/agent"
-	agentd "github.com/loft-sh/devpod/pkg/daemon/agent"
-	"github.com/loft-sh/devpod/pkg/log"
+	"github.com/curityio/devpod/pkg/agent"
+	agentd "github.com/curityio/devpod/pkg/daemon/agent"
+	"github.com/curityio/devpod/pkg/log"
 	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"

cmd/agent/container/openvscode_async.go

@@ -3,11 +3,11 @@ package container
 import (
 	"encoding/json"
 
-	"github.com/loft-sh/devpod/cmd/flags"
-	"github.com/loft-sh/devpod/pkg/compress"
-	"github.com/loft-sh/devpod/pkg/devcontainer/config"
-	"github.com/loft-sh/devpod/pkg/ide/openvscode"
-	"github.com/loft-sh/devpod/pkg/log"
+	"github.com/curityio/devpod/cmd/flags"
+	"github.com/curityio/devpod/pkg/compress"
+	"github.com/curityio/devpod/pkg/devcontainer/config"
+	"github.com/curityio/devpod/pkg/ide/openvscode"
+	"github.com/curityio/devpod/pkg/log"
 	"github.com/spf13/cobra"
 )
 

cmd/agent/container/setup.go

@@ -13,31 +13,31 @@ import (
 	"strconv"
 	"strings"
 
+	"github.com/curityio/devpod/cmd/flags"
 	v1 "github.com/google/go-containerregistry/pkg/v1"
-	"github.com/loft-sh/devpod/cmd/flags"
-
-	"github.com/loft-sh/devpod/pkg/agent"
-	"github.com/loft-sh/devpod/pkg/agent/tunnel"
-	"github.com/loft-sh/devpod/pkg/agent/tunnelserver"
-	"github.com/loft-sh/devpod/pkg/command"
-	"github.com/loft-sh/devpod/pkg/compress"
-	config2 "github.com/loft-sh/devpod/pkg/config"
-	"github.com/loft-sh/devpod/pkg/copy"
-	"github.com/loft-sh/devpod/pkg/credentials"
-	"github.com/loft-sh/devpod/pkg/devcontainer/config"
-	"github.com/loft-sh/devpod/pkg/devcontainer/setup"
-	"github.com/loft-sh/devpod/pkg/dockercredentials"
-	"github.com/loft-sh/devpod/pkg/envfile"
-	"github.com/loft-sh/devpod/pkg/extract"
-	"github.com/loft-sh/devpod/pkg/git"
-	"github.com/loft-sh/devpod/pkg/ide/jetbrains"
-	"github.com/loft-sh/devpod/pkg/ide/jupyter"
-	"github.com/loft-sh/devpod/pkg/ide/openvscode"
-	"github.com/loft-sh/devpod/pkg/ide/rstudio"
-	"github.com/loft-sh/devpod/pkg/ide/vscode"
-	"github.com/loft-sh/devpod/pkg/log"
-	provider2 "github.com/loft-sh/devpod/pkg/provider"
-	"github.com/loft-sh/devpod/pkg/single"
+
+	"github.com/curityio/devpod/pkg/agent"
+	"github.com/curityio/devpod/pkg/agent/tunnel"
+	"github.com/curityio/devpod/pkg/agent/tunnelserver"
+	"github.com/curityio/devpod/pkg/command"
+	"github.com/curityio/devpod/pkg/compress"
+	config2 "github.com/curityio/devpod/pkg/config"
+	"github.com/curityio/devpod/pkg/copy"
+	"github.com/curityio/devpod/pkg/credentials"
+	"github.com/curityio/devpod/pkg/devcontainer/config"
+	"github.com/curityio/devpod/pkg/devcontainer/setup"
+	"github.com/curityio/devpod/pkg/dockercredentials"
+	"github.com/curityio/devpod/pkg/envfile"
+	"github.com/curityio/devpod/pkg/extract"
+	"github.com/curityio/devpod/pkg/git"
+	"github.com/curityio/devpod/pkg/ide/jetbrains"
+	"github.com/curityio/devpod/pkg/ide/jupyter"
+	"github.com/curityio/devpod/pkg/ide/openvscode"
+	"github.com/curityio/devpod/pkg/ide/rstudio"
+	"github.com/curityio/devpod/pkg/ide/vscode"
+	"github.com/curityio/devpod/pkg/log"
+	provider2 "github.com/curityio/devpod/pkg/provider"
+	"github.com/curityio/devpod/pkg/single"
 	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"

cmd/agent/container/setup_windows.go

@@ -3,7 +3,7 @@
 package container
 
 import (
-	"github.com/loft-sh/devpod/cmd/flags"
+	"github.com/curityio/devpod/cmd/flags"
 	"github.com/spf13/cobra"
 )
 

cmd/agent/container/vscode_async.go

@@ -3,11 +3,11 @@ package container
 import (
 	"encoding/json"
 
-	"github.com/loft-sh/devpod/cmd/flags"
-	"github.com/loft-sh/devpod/pkg/compress"
-	"github.com/loft-sh/devpod/pkg/devcontainer/config"
-	"github.com/loft-sh/devpod/pkg/ide/vscode"
-	"github.com/loft-sh/devpod/pkg/log"
+	"github.com/curityio/devpod/cmd/flags"
+	"github.com/curityio/devpod/pkg/compress"
+	"github.com/curityio/devpod/pkg/devcontainer/config"
+	"github.com/curityio/devpod/pkg/ide/vscode"
+	"github.com/curityio/devpod/pkg/log"
 	"github.com/spf13/cobra"
 	"github.com/spf13/pflag"
 )

cmd/agent/container_tunnel.go

@@ -8,15 +8,15 @@ import (
 	"os/signal"
 	"syscall"
 
-	"github.com/loft-sh/devpod/cmd/agent/workspace"
-	"github.com/loft-sh/devpod/cmd/flags"
-	"github.com/loft-sh/devpod/pkg/agent"
-	"github.com/loft-sh/devpod/pkg/devcontainer"
-	"github.com/loft-sh/devpod/pkg/devcontainer/config"
-	"github.com/loft-sh/devpod/pkg/devcontainer/setup"
-	"github.com/loft-sh/devpod/pkg/encoding"
-	"github.com/loft-sh/devpod/pkg/log"
-	provider2 "github.com/loft-sh/devpod/pkg/provider"
+	"github.com/curityio/devpod/cmd/agent/workspace"
+	"github.com/curityio/devpod/cmd/flags"
+	"github.com/curityio/devpod/pkg/agent"
+	"github.com/curityio/devpod/pkg/devcontainer"
+	"github.com/curityio/devpod/pkg/devcontainer/config"
+	"github.com/curityio/devpod/pkg/devcontainer/setup"
+	"github.com/curityio/devpod/pkg/encoding"
+	"github.com/curityio/devpod/pkg/log"
+	provider2 "github.com/curityio/devpod/pkg/provider"
 	"github.com/spf13/cobra"
 )
 

cmd/agent/daemon.go

@@ -8,12 +8,12 @@ import (
 	"strings"
 	"time"
 
-	"github.com/loft-sh/devpod/cmd/flags"
-	"github.com/loft-sh/devpod/pkg/agent"
-	"github.com/loft-sh/devpod/pkg/client/clientimplementation"
-	"github.com/loft-sh/devpod/pkg/driver/custom"
-	"github.com/loft-sh/devpod/pkg/log"
-	provider2 "github.com/loft-sh/devpod/pkg/provider"
+	"github.com/curityio/devpod/cmd/flags"
+	"github.com/curityio/devpod/pkg/agent"
+	"github.com/curityio/devpod/pkg/client/clientimplementation"
+	"github.com/curityio/devpod/pkg/driver/custom"
+	"github.com/curityio/devpod/pkg/log"
+	provider2 "github.com/curityio/devpod/pkg/provider"
 	"github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
 )

cmd/agent/docker_credentials.go

@@ -11,10 +11,10 @@ import (
 	"strconv"
 	"strings"
 
-	"github.com/loft-sh/devpod/cmd/flags"
-	"github.com/loft-sh/devpod/pkg/dockercredentials"
-	devpodhttp "github.com/loft-sh/devpod/pkg/http"
-	"github.com/loft-sh/devpod/pkg/log"
+	"github.com/curityio/devpod/cmd/flags"
+	"github.com/curityio/devpod/pkg/dockercredentials"
+	devpodhttp "github.com/curityio/devpod/pkg/http"
+	"github.com/curityio/devpod/pkg/log"
 	"github.com/spf13/cobra"
 )
 

cmd/agent/git_credentials.go

@@ -10,10 +10,10 @@ import (
 	"os"
 	"strconv"
 
-	"github.com/loft-sh/devpod/cmd/flags"
-	"github.com/loft-sh/devpod/pkg/gitcredentials"
-	devpodhttp "github.com/loft-sh/devpod/pkg/http"
-	"github.com/loft-sh/devpod/pkg/log"
+	"github.com/curityio/devpod/cmd/flags"
+	"github.com/curityio/devpod/pkg/gitcredentials"
+	devpodhttp "github.com/curityio/devpod/pkg/http"
+	"github.com/curityio/devpod/pkg/log"
 	"github.com/spf13/cobra"
 )
 

cmd/agent/git_ssh_signature.go

@@ -3,9 +3,9 @@ package agent
 import (
 	"errors"
 
-	"github.com/loft-sh/devpod/cmd/flags"
-	"github.com/loft-sh/devpod/pkg/gitsshsigning"
-	"github.com/loft-sh/devpod/pkg/log"
+	"github.com/curityio/devpod/cmd/flags"
+	"github.com/curityio/devpod/pkg/gitsshsigning"
+	"github.com/curityio/devpod/pkg/log"
 	"github.com/spf13/cobra"
 )