[development] RFC: letting modules phone home to check for new releases

[Derek Wright]

(if you're impatient and won't read this message ;) please comment here:
http://drupal.org/node/94154 -- "module page could say if new  
releases are available").

one of the many benefits of the new release system is that contrib  
maintainers can now make an official release when they think their  
users should upgrade.  this is particularly important for security  
fixes.

my goal is for the admin/build/modules page to tell you if you're  
running out-of-date code.  project.module just has to provide an RSS  
feed for new release nodes and/or an XML-RPC interface so that  
something on the modules page can either display the aggregated feed  
items in a block, or the UI could directly display the needs-update  
info.  for example, you visit your modules page and the row for one  
of your installed contribs is now bright red with a giant warning:

"SECURITY UPDATE RELEASED FOR THIS VERSION, YOU ARE URGED TO UPGRADE  
IMMEDIATELY"

wouldn't that be slick? ;)

my goal is to get this into core someday.  it's too late in 5.x for  
that.  however, since the modules page is all happy FAPI, we could do  
this via a form_alter()'ing contrib for 5.x and see that eventually  
migrate into core in 6.x or beyond.

why am i asking for comments?

there needs to be some more data in the .info files for 5.x modules  
if a contrib is going to be able to do this properly.  as of today,  
the packaging script on drupal.org that creates the downloadable  
tarballs will automatically append the version of your module into  
the .info files[1].  this is b/c the modules page in core is about to  
be enhanced to display this data[2].  however, just knowing the  
version and the human-readable name of the module isn't enough for a  
5.x contrib to be able to find out if your code is out of date.  we  
also need something along the lines of:

; Project identification
Project home = drupal.org
Project name = views

then, the soon-to-be-written check_updates.module can get this info  
and use it to construct the right URLs for the XML-RPC calls or to  
find the right RSS feed, etc.

the packaging script can easily add this info automatically, but i  
need to finalize exactly what the fields are going to be called and  
what data they should really hold.  i don't want to just hard-code a  
full URL since the project.module changes aren't done to provide the  
info yet, and we might change our mind on exactly the right path to  
use (and XML-RPC vs. RSS, etc).  also, we can't assume *every* module  
installed on your site is from drupal.org, since that would break  
things for 3rd-party modules or custom-built ones.  in that case,  
"Project home" should point to something else, or not exist at all.   
similarly, using a "Project name" instead of a "Project nid" is both  
more sane for end users to grok, and provides a level of indirection  
in case project nodes ever move around, get deleted and re-created,  
whatever.

i *really* want to get this data into the .info files ASAP so that  
there aren't many 5.x contribs out in the wild that are missing it.   
however, i don't want to just unilaterally decide the fields and  
format of the values without any input from the rest of you.  so,  
please comment ASAP here:

http://drupal.org/node/94154

thanks!
-derek

[1] http://drupal.org/node/97286
"automatically insert human-readable version into .info files"

[2] http://drupal.org/node/87298
"Add version info to modules page"