Mark packages out of date automatically

[jelly]

Either by using repology, https://release-monitoring.org/ or nvchecker

[jelly]

release-monitoring doesn't seem to provide a nice API, but only a fedmsg which has a package in the AUR.

https://fedmsg.readthedocs.io/en/stable/subscribing/ subscribe to it and check for the "anitya.project.version.update" topic.

[jelly]

A different controversial thought is defining the source watch url in our git repo or as part of the PKGBUILD similiar to debian's watch file. Since nvchecker/urlwatch require specific tweaks per upstream url which makes it very hard.

[jelly]

One option is repology for now:

r = requests.get('https://repology.org/api/v1/projects/?inrepo=arch&outdated=1')
print(r.json().keys())

[jelly]

Or use https://wiki.debian.org/debian/watch

[z3ntu]

I've integrated the release-monitoring.org API into the postmarketOS pmbootstrap tool. Here are some thoughts on it:

Advantages:

• Many projects are registered on that site.
• Custom package name mapping support (for when a package has a different name upstream compared to the package name)
• Relatively nice API - terminology is a bit confusing at first ("projects" vs "packages") - but it's actually relatively simple

Disadvantages:

• Bug fix rollouts on the website are really slow; edit 2020-07-24: there have been cases of projects getting "randomly" deleted because of a bug, I'm not convinced the admins of release-monitoring.org care particularly much about the data :/
• Some projects have invalid versions shown as "latest", for example qmltermwidget: https://github.com/Swordfish90/qmltermwidget/tags (the 0.6.0 tag comes from the "qtermwidget" project where qmltermwidget was forked from)
• ~~Projects API doesn't have a case insensitive search (while the website does), see https://github.com/release-monitoring/anitya/issues/807 , requiring custom mapping to be created~~ merged now
• Some projects are registered multiple times e.g. once with PyPI source, once with GitHub source