Flathub JSON recipes

[Robert McQueen]

Hi all,

A commenter on my blog has just reminded me of something:
 http://ramcq.net/2017/07/29/welcome-flathub/#comment-144379

I was discussing this with Christian Hegert at GUADEC and we forgot to
follow up any further during the Flatpak/Flathub BOF. Builder relies on
having the .json file inside the project repository as a complete
description of how to build and run it - dependencies, runtime, etc - so
you can check out a project, build & run in two clicks of the mouse.

For a while in GNOME, we were working on including the .json file within
each module, which obviously works well with this flow, but now (seeing
Alex push a lot of new, separate modules into Flathub for the GNOME
apps) the Flathub approach of separating the recipes from the
application in separate repos breaks this flow.

The commenter on my blog was also concerned about the split of repos and
potentially of access permissions in this scenario, recreating some of
the regular Linux distro structure of packagers and developers being
distinct groups of people. Flatpak is aiming to disintermediate here -
does Flathub need to do better at this too?

Should/could we also support (and indeed, encourage) a mode where
Flathub can follow a stable branch on a upstream repo, and instead
obtain the .json from there?

I can see certain activities where Flathub would very much wish to have
the source on hand to do things like CVE scanning or other kinds of
linting, but these can also just as likely be done with mirrors or
triggered as part of the build flow.

Any thoughts?

Cheers,
Rob