funding.json

[Changaco]

We've been pinged on Mastodon about a relatively new standard I wasn't aware of: https://fundingjson.org/

The possible use of it I can think of right now is the automatic verification that a Liberapay account and a repository or website are controlled by the same person. Relevant issues: #661, #943 and #2425 for repositories, #1034 for websites.

[Suprnova]

Hey, just wanted to post the observations I've made while looking into this.

funding.json doesn't provide the same functionality as importing repositories from GitHub or GitLab, so implementing it on top of the existing repositories feature wouldn't be possible without modification. There's no way to determine the is_fork, stars_count, or importantly, the mandatory last_update field, with the manifest file alone. By that point, I don't believe this should be seen as a replacement for proper OAuth support for the linked issues. It should work fine for verifying website ownership, however.

I assume for a repository/website to be considered "verified", the manifest should either be under the same project/hostname or pass the wellKnown check. What should the plan be for handling unverified projects? FLOSS/Fund's solution is to denote unverified links with a warning symbol, but this would introduce a third state of linked but unverified to a connections system that is otherwise linked or not linked.

A cron job would have to be added to validate the presence and validity of the funding.json file, similar to the existing refetch_repos job. Building off of the previous observation, what should occur when a connection that was previously verified is no longer so, or if a previously valid manifest file is now invalid? Should the impacted connections be removed immediately, marked as unverified, given a grace period, etc.? Should the user be notified via email?

As an aside, parsing a funding.json file is a somewhat involved process, requiring web crawling, well-known parsing, extra logic for repository hosters, etc., and there is only one library, written in Go, that has any real-world usage. If liberapay were to have its own Python implementation of parsing this manifest file, I think it'd be a waste to not publish and maintain it as its own package.

[Changaco]

Hey, thanks for posting such a well researched comment.

is_fork, stars_count and last_update are nice to have but not strictly necessary, and they're all public values that could be obtained in other ways without needing OAuth.

I think it would be fine for Liberapay to simply refuse to list repositories/websites it can't verify. Of course an explanation should be given to the account owner so that they can look into fixing the problem on their side.

A periodic check that fails should be retried multiple times at increasing intervals. Ideally the account owner would be notified some time before the links are removed.