flatpak-external-data-checker VS flatpak-builder-tools

> Maybe. The CI rules should be made public in that case, though, surely? Maybe they are?

Agreed, but thankfully they are. The PRs link to <https://github.com/flathub/flatpak-external-data-checker>. That said, it'd be clearer if the flathubbot 'user' profile also linked to that URL.

> The enormous amount of value the distros bring [...] is audit of packages (and packaging).

Yes, auditing against supply chain attacks is good! But there's also a risk in running outdated software. I don't have easy answers. But if automation leaves more time for the hard part, great.

Flathub provides an excellent tool to keep your dependencies up to date, so it's just a matter of adding it to the manifests. Besides, who says 'dependencies not being updated enough' is a valid metric to determine the quality of a package? LOL.

According to Github issue/PR #126 new builds are failing because of a bug in flatpak-external-data-checker or some incompatibility between the two projects at least.

I'm surprised the documentation says that since Flathub itself runs its CLI scripts via Flatpak: https://github.com/flathub/flatpak-external-data-checker

Another thing you could add would be to tag your releases on GitHub, add a tag field next to the commit one, and add an x-checker-data section to the manifest so the Flathub bot will automatically open PRs to update the Flatpak release when you update your repository.

See f-e-d-c, and if you're not planing to submit to Flathub, then look at the GitHub workflow example there. Be aware that auto-merging is not acceptable for anything other than extra-data sources.

Unfortunately the maintainership of the Zoom Flatpak on Flathub has been a bit slow, but you can still install it since the Flathub bot do automatic builds whenever there's an update, thanks to the provided flatpak-external-data-checker service.

There is https://github.com/flathub/flatpak-external-data-checker which automatizes the update pull requests including dependencies. Flatpak has other downsides, but security or not getting the latest and greatest is not one of them.

Setting the build configuration for a module with things like type: autotools, type: cmake-ninja, or type: meson will add the necessary options automatically. Likewise, helper scripts like flatpak-pip-generator will generate manifest fragments containing the necessary prefix-specifying arguments.

There's also this pull request https://github.com/flatpak/flatpak-builder-tools/pull/347 that would add an --ignore-installed= option to flatpak-pip-generator.

Yeah, turns out I had to do something similar to this. flatpak-dotnet-generator proved pretty useful, even if the README was a bit out of date.

If you want it automated, for most packages you can use flatpak-pip-generator

The first issue I had was working out how I add PyPI packages as deps, then I was pointed towards flatpak-pip-generator which generates JSON files that you can add as modules. That works fine:

For packaging with local cache and without networking, use the flatpak-go-get-generator.py from flatpak-builder-tools. I didn't have much success recently with go-get generator, so I'm not sure if working correctly, or it's just me doing something wrong.

I am trying to install `flatpak-pip-generator` found in the link here. It looks like it is part of the `flatpak-builder` package but I have that installed and I can't seem to use the pip-generator. I run the command listed in the readme `flatpak-pip-generator --requirements-file=/the/path/to/requirements.txt --output pypi-dependencies

That one page in the docs does mention that tricky things like dependency resolution have to be done in advance, but support for building that dependency resolution is at best officially unsupported. There's a git repo dedicated to scripts to do this sort of thing but:

It would be nice to see some Crystal apps on flathub (I believe Hashbrown is the only one at the moment). A crystal sdk (like rust's) and a shard builder tool to generate the shards automatically would greatly improve the experience, if anyone is up to doing them.