It seems, this task/problem has truly no priority, as @epriestley mentioned in his task description already. After skimming through related T5055, that idea reminded me of https://aur.archlinux.org/.

So, I'll follow the route suggested now: Community Resources.

Thanks @avivey for sorting me in here.

@rscircus - this task (like I assume most tasks here) needs paid prioritization to move forward. see https://secure.phabricator.com/w/prioritization/

In T10038#203547, @cspeckmim wrote:

@rscircus - this task (like I assume most tasks here) needs paid prioritization to move forward. see https://secure.phabricator.com/w/prioritization/

Oh really? Nice to hear, that I'll get monetary appreciation for contributing. 😉

In T10038#150670, @epriestley wrote:

Do you see there being a "Blessed" foo-linter (maybe as a repo on this instance?), or will there be multiple foo-tributes fending themselves in the wilds of github?

This is all still pretty early, but I imagine this instance mostly just collecting packages into a directory for now. The actual source might be on GitHub, but you'd be able to search this instance to find all foo-linter extensions by authors who had bothered to register their packages.

In some cases, we'd likely pull linters out of arc and turn them into Phacility-Published extensions (secure.phabricator.com/phacility/foo-linter) which we'd sign. These would be "blessed", as long as you continue trusting our signing keys.

In some cases, I'd like to "soft-bless" extensions as "safe, but don't come to us for support" with some sort of "Community Badge of Quality" key. For example, you might publish a secure.phabricator.com/cburroughs/foo-linter) which we'd sign in an advisory way which mean "we looked at the code, it seems fine, but we aren't taking bug reports for it". The UI and arc install would show users that someone they trust also trusts this code.

In some cases, untamed wilds, but collected in one place and searchable, with signing and a consistent toolset.

If nothing is blessed, you may have to make a decision like this yourself:

$ arc install foo-lint
Query "foo-lint" matches multiple packages:

  secure.phabricator.com/alice/foo-lint
  secure.phabricator.com/bob/foo-lint

None of these packages or vendors are signed by anything you trust.

Which package do you want to install?

But I think that should be OK. And we can do some level of positive and negative curation (advisory signing on good packages, disabling bad packages)..

You'll also be able to have an internal package directory for your company's stuff, so you can just publish internal things to it and then everyone can use standard tools to manage extensions.

Some day far in the future I could imagine the package directory integrating with other applications (e.g., giving each package its own repositories and tasks, like GitHub) but that's definitely far in the future. I expect most extensions (like linter bindings) to be small so they wouldn't get much benefit (e.g., 100 lines of code updated a couple times a year) and large extensions (eventually, third-party applications) to probably want to self-host on their own Phabricator instances in most cases.

The immediate goal is just fixing the problem that distributing extensions is a huge pain and all solutions have major downsides, with "convince the upstream to accept the extension" being the best option for everyone but us. The new distribution mechanism would be:

$ arc lint
Okay, automatically installing all the extensions this project needs.

(...prompts if you need to trust new stuff...)

Done!
...
nice lint output

Which fixes distribution. In the long run, there's a lot we can do to build stronger ecosystem tools, but I'm less worried about tackling that stuff today than I am about moving distribution to a broadly reasonable mechanism.

I'm a fan of the way that Puppet has handled this on the Puppet Forge. Basically, there are [[https://forge.puppet.com/puppetlabs | puppetlabs]] modules, which are officially supported, and then there are also [[https://forge.puppet.com/puppet | puppet]] modules, which are maintained by the "Puppet Community" (although I'm not sure exactly who comprises this community). Typically, it seems that popular modules will be "taken over" (after consultation with the current maintainers of the module) by the community.

@epriestley I like the work going on to externalize the linters, and I understand why you would merge the tasks.

Will you accept a new differential fixing the current linters, or are they on hold until the code gets pulled out?

This is all frozen until we sort it out more generally.