eget VS flatpak-external-data-checker

View on GitHub

would be good if you added a comparison with https://github.com/zyedidia/eget on your repo

There used to be a project called ginstall.sh that kept like, a manually maintained database of various projects with static binaries and how to install them. It still exists, but maintenance stopped because its model was also not sustainable. Its use case is better covered by tools like asdf, stew, and if you want to get even simpler, eget.

I'm a huge fan of asdf and have been using for years together with direnv! It's great to see how much effort is put into it! I hope more people adopt it so that we don't have to `curl | sh`! One thing I have issues with asdf is security as are no checksums, so, you if I project get compromised you'll get compromised, too. This, of course, is in addition to the third-party asdf plugin getting itself compromised (which is the greater risk). Last, but not least - I wish asdf came with something like eget [0] incorporated so that it can install 99% of the plugins directly and safely! Last, but not least - 99% of the plugins have almost identical code and all that changes is the repo, so, this should be generalized. For example, many years ago I made just one codebase of all HashiCorp plugins [1] and it's been working great!

[0]: https://github.com/zyedidia/eget

[1]: https://github.com/asdf-community/asdf-hashicorp

> Maybe. The CI rules should be made public in that case, though, surely? Maybe they are?

Agreed, but thankfully they are. The PRs link to <https://github.com/flathub/flatpak-external-data-checker>. That said, it'd be clearer if the flathubbot 'user' profile also linked to that URL.

> The enormous amount of value the distros bring [...] is audit of packages (and packaging).

Yes, auditing against supply chain attacks is good! But there's also a risk in running outdated software. I don't have easy answers. But if automation leaves more time for the hard part, great.

Flathub provides an excellent tool to keep your dependencies up to date, so it's just a matter of adding it to the manifests. Besides, who says 'dependencies not being updated enough' is a valid metric to determine the quality of a package? LOL.

According to Github issue/PR #126 new builds are failing because of a bug in flatpak-external-data-checker or some incompatibility between the two projects at least.

I'm surprised the documentation says that since Flathub itself runs its CLI scripts via Flatpak: https://github.com/flathub/flatpak-external-data-checker

Another thing you could add would be to tag your releases on GitHub, add a tag field next to the commit one, and add an x-checker-data section to the manifest so the Flathub bot will automatically open PRs to update the Flatpak release when you update your repository.

See f-e-d-c, and if you're not planing to submit to Flathub, then look at the GitHub workflow example there. Be aware that auto-merging is not acceptable for anything other than extra-data sources.

Unfortunately the maintainership of the Zoom Flatpak on Flathub has been a bit slow, but you can still install it since the Flathub bot do automatic builds whenever there's an update, thanks to the provided flatpak-external-data-checker service.

There is https://github.com/flathub/flatpak-external-data-checker which automatizes the update pull requests including dependencies. Flatpak has other downsides, but security or not getting the latest and greatest is not one of them.