Pull from sources other than Git (including binary sources) about toltec HOT 4 CLOSED

This is tied to the question of whether we want to restrict this repository to free software. I’m personally inclined to limiting the packages we distribute to free software because:

• I believe we should encourage the community to create free software.
• When distributing proprietary software, we need to obtain and maintain a per-app redistribution permission from each author.
• It’s harder for users to inspect binaries when the source code is not available.

I’m open to other opinions on the matter, however.

from toltec.

Technically free software can just distribute pre-built binaries and then release source as requested. That said, I'd also think that for transparency’s sake it would be good to stick with git repositories for now. If/when someone wants to handle building themselves, or we want to package something that's already been built by another group using an odd build-chain, we can look at adding in alternative ways to pull "source".

The one caveat I do have to this though is that it might make sense to allow pulling down binary resource files that people don't want to store in git due to their size. Again, lets wait until someone actually runs into it.

Adding the ability to include checksums would be nice though.

from toltec.

Agreed. I’ll close this for now, but this is almost certainly something we’ll have to revisit when the need arises.

from toltec.

i think that ease of installation and updating is most important to me, followed by security and then software freedoms.

currently: everyone goes to random github repos to get their software. if a dev chooses to only release binaries, then the end user is installing non-free pre-compiled binaries. what we can provide is:

• centralized repo for software (discovery of software happens in one place vs. many)
• vetting the binaries are the version that was tested by the packager (by using checksumming and hashing)
• ability to update the binaries when the dev releases new updates

the danger here (in my opinion) is if a dev pushes an update that is malicious and the software repository ends up distributing it and because more people have the repo installed it end up infecting more people than if we didn't have the app repo distribution channel. in this case, once the bad code is caught, the software repo will be able to update everyone and that is better than if there was no app repo.

from toltec.