Zilog80 Also, when are we getting a proper package manager like Brew?
The interesting point to me isn't really about "bypassing" anyone, it's a structural gap the platform has always carried. HaikuDepot only shows you what flows through HaikuPorts. Everything else exists but stays invisible unless you already know the URL: apps published straight to GitHub releases, BeSly, Fat Elk, Clasqm, the old BeOS archives. BeOS had BeBits for exactly this, and we never rebuilt it.
I keep wondering how an index could work that aggregates all these sources that already exist, pointing at the original authors instead of re-hosting the binaries. In theory a "tap" could just be a git repo of small manifests (name, release URL, hash, architecture), so anyone could publish one in five minutes, with no haikuporter recipe to write and no build infrastructure to set up. Maybe with different channels for the same app: a stable version, pinned and hashed, and a nightly one that follows the author's latest release. Which is the thing HaikuPorts, by design, can't do.
The part that feels most delicate is that something like this would only work if it's additive to HaikuPorts, not an alternative. Dependencies resolved through the normal system solver against the repos that already exist, and if an app also lives on HaikuPorts the manifest says so and points you to the curated version. Something like the relationship between the AUR and the official Arch repos, the nursery rather than the competitor. If anything, a slice of the value would flow back to HaikuPorts.
And then the trust problem, because aggregating sources you don't control is where these things usually break: signed manifests, maybe an append-only log of publications, so a federated index doesn't turn into a vehicle for slipping anything through.
