"self" when packaging a webpub

[chocolatkey]

If delivering a publication as a webpub package (as described here: https://github.com/readium/webpub-manifest#8-package), what should the "self" link be set to? "A manifest must contain at least one link using the self relationship where href is an absolute URI to the canonical location of the manifest", so it cannot be left out (and I'm fine with that), but if it served from say an ephemeral URL (for security reasons), and is on the user's device, what is its self href?

[HadrienGardeur]

Ideally the self URL for a packaged or cached publication should point to a place where the user/UA can get an updated version of the manifest.

There's currently no restriction whatsoever regarding how such URLs should be protected though, which means that you might need to authenticate before being able to fetch an updated manifest.

As we explore additional profiles (audiobooks, DiViNa) we might need to re-consider this requirement since we can't always expect a packaged publication to have a presence on the Web. We could for example turn this into a requirement for a URL instead of an absolute URL, which would allow packaged publications without a presence on the Web to simply include a relative path into the package.

[llemeurfr]

We can consider that a packaged publication which does not originate from a publication "exposed" on the Web has not self link.

This will be the case for audiobooks encrypted by an LCP server (the source will be a W3C Audiobook, the target an audiobook with a Readium WebPub Manifest, i.e. a "Readium Audiobook".

It means that the json schema which validates such a Readium WebPub Manifest must not make the self link a MUST.