1985454 - [Flatpak]: Provide a Sources extension for Thunderbird

Status: UNCONFIRMED

(Thunderbird :: Build Config, enhancement)

Description

[bbhtt]

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:143.0) Gecko/20100101 Firefox/143.0

Steps to reproduce:

Flatpak manifests built with flatpak-builder can generate a “Sources extension” for the built manifest on passing --bundle-sources.

This basically contains the raw sources that were specified in the manifest to build the app e.g. tarballs, debs, bare git mirrors etc.

The files inside a typical sources extension look like:

downloads/<sha 256 hash>/foobar.tar.xz
git/https_git_github_com_foobar_baz_git/<bare git repo>
manifest/foobar.patch
manifest/foobar.desktop
manifest/foobar.appdata.xml

Assuming these were used to build the app.

Since Thunderbird is not directly built using flatpak-builder, the easy way (passing --bundle-sources) to generate the sources extension cannot be used.

It can however produce its own Sources extension oob. Having the Sources extension would enable Flathub to run reproducibility checks for the published version of Firefox on Flathub.

So it'd be nice to have a sources extension. Basically in case of Thunderbird, it'd be creating a directory and putting the following files in them:

downloads/<sha 256 hash>/thunderbird-108.tar.xz
manifest/thunderbird.desktop
manifest/thunderbird.appdata.xml

Then running an ostree command to make that directory into a sources extension. Something like this should work in theory:

ostree commit --repo=repo --canonical-permissions --branch="runtime/org.mozilla.Thunderbird.Sources/x86_64/stable" source_dir

Actual results:

Missing sources extension for latest published version on Flathub

Expected results:

org.mozilla.Thunderbird.Sources extension should be published to Flathub along with Firefox as laid out above.