[Bro-Dev] Package manager meta data

[Siwek, Jon]

> On Nov 20, 2016, at 1:57 PM, Robin Sommer <robin at icir.org> wrote:
> 
> What will be the relationship between version tags and the master
> branch? Is master just another version I can select to install?

Yes, any tag or branch can be selected with `bro-pkg install —version <version or branch>`.

When selecting a version, `bro-pkg update` only considers newer x.y.z release tags for that package.  When selecting a branch, it tracks updates along that branch.

>> 4) new command/flag `bro-pkg refresh --aggregate-metadata <pkg
>> source>`:
> 
> A shortcut "bro-pkg refresh" might be useful here that simply does
> that for all configured sources.

I’ll make —aggregate flag operate on all sources then add an optional "—source <source>” flag for those that just want to operate on a single one.

`bro-pkg refresh` without any flags is currently like a `git pull` from the remote source and what most users will be doing.  Likely only the operators of sources will want to —aggregate (if the package ecosystem becomes large, this operation could take a while to complete).

> Also, what if I update the meta information locally, but then later
> the remote repository updates its version as well, so that mine gets
> stale. Would the newer remote version replace the local version?

Yes, newer data from the remote source overwrites local changes.

>> single file at the top-level named “aggregate.meta”.  Only metadata
>> from current master branches of packages is included
> 
> Depending on the answer to the version question above, an alternative
> could be using the most recent version (i.e., the commit that that
> version tag refers to). That way people could control a bit better
> when meta data gets updated (it's when they set a new version). It
> would still fallback to master if no version tag is set.

Sounds good, I’ll have it do that.

- Jon