Distributors entering Flatpakland

Every application using Flatpak includes the full manifest of its dependencies, including the source archive (tarball with checksum or git repository plus commit id, plus the location of eventual patches) inside the archive itself, as a machine parseable file. That also applies to the manifest of each run time.

It would be entirely possible today to write a simple script that took that manifest and downloaded every single dependency into a specific location.