Getting to know the r-multiverse project

[Crosita]

Get familiar with r-multiverse and how we could point to it for our risk metrics calculation

[dgkf]

Just following up on the specific question that we touched upon today: What would it look like to host an index of packages that layers r-multiverse atop rhub/repos?

Using a recent build of mirai as an example, we can find its binary by looking at the GitHub action in which the binary was built.

In the build logs we find an artifact url for downloading the binary. This artifact is then uploaded to the r-universe package server using this action. I haven't figured out exactly where they get uploaded, but I think it's a dedicated file server hosting R universe, not release artifacts on GitHub similar to r-hub/repos.

We'd be able to discover these sources to produce a common PACKAGES file. However, we would not have control over which images would be used to build binaries.