Allow non Thunderstore sites for verifed mods

[EM4Volts]

Idea is to also allow GitHub releases as a source for verified mods. Since they already have hashes etc to compare before even downloading.

[GeckoEidechse]

If done, we need to revert #535

Which brings me to a good point. How do we best namespace mods from GitHub?

From the top of my head we could split up the folders based on download source and then use the respective namespace for each platform.
So we'd have something like

• runtime/remote/mods/Thunderstore/AUTHOR-MOD-VERSION/
• runtime/remote/mods/GitHub/GHAUTHOR-GHREPO-VERSION/

or the like. For GitHub mods we could also use a different delimiter than -. Should best be something that is allowed as a filename on Windows (so no : or ? for example) but not allowed as a GitHub username or repo name so that we don't even need to check whether GHAUTHOR or GHREPO contain the delimiter.

Which thinking of, (space) might actually work for this lol

[EM4Volts]

Here are some thoughts behind this:

Thunderstore issues.

Over the past days there was some Thunderstore update that broke some stuff for other games. Not for us luckily but who knows what the future holds.
Sure GitHub could f up in the same way at some point but its highly unlikely since, well, it's GitHub u know."

Source code

We already require the source code to be on GitHub and even include repos in the verified mods json, why not just allow the downloads straight from there.

Better control

GitHub already has a hash for releases, commits etc. making it easy to use that for verification.

Quality

I think less "low quality" mods will be sent in for verification if github was the source instead of thunderstore since it would require people to know GitHub a bit more then just "upload code > setup action"

[GeckoEidechse]

100% agree on the longevity part. Veri-MAD ¹ is still in its infancy which means if there's any moment to adjust the system still it should be now, rather than later.

I think, what we should do is adjust the system to allow for alternate sources (whether they be GitHub or another place).

That would involve the following changes:

• Update the verified-mods.json and the corresponding schema.json
  I would suggest simply re-anchoring the current JSON under a new root called thunderstore, so that we can later add new keys for github, gitlab, my-awesome-modding-site, etc.
• Update the launcher code for the new JSON file
• Update the download location as proposed here to be in a thunderstore subfolder so that we have different locations for different remotes to prevent naming collisions.
  Note that this would mean that existing already downloaded mods would get ignored by launcher and redownloaded. Given that remote mods are supposed to be ephemeral anyway, this is not really a concern IMO and I also got an issue on FlightCore up to allow for cleaning up old mods

If anyone wants to start working on these, the last one in particular is even completely independent of the rest, I'd be more than happy to take some PRs <3

Footnotes

1. Verified mod-auto-download (love that name lmao) ↩

[Jan200101]

It would also be useful if direct URLs could be specified to a mod.
This would allow people to self-host their mods or use lesser used plotforms that provide direct downloads.
Since mods are already vetted for and hash checked this should not cause security issues.

[GeckoEidechse]

My biggest concern with arbitrary sources would be that the endpoint could be controlled by a malicious entity do fucky stuff with the connection like slowing down the connection for some users. Another hypothetical scenario would be that should there for example be a vulnerability in the curl implementation we use that an arbitrary endpoint could exploit, we have to be a lot more proactive in fixing it.

Not saying we shouldn't do that regardless but this increases the need to update quickly for a project that is still entirely community maintained.

So overall, until there's a special need for custom endpoints, I think we should try to avoid them for as long as possible ^^"

[RoyalBlue1]

cant we make the game be able to download from any source and then only allow specific ones on the whitelist that makes it possible to add new sources without needing to change launcher

[GeckoEidechse]

I'd be fine with that. We just need to make sure that we keep track of the source on extract so that we can put the mod in the right location ^^