The "app repository" is a github repository [1]. I'm not sure how I feel about that. It worked for appget, it's easy to audit, nobody can do any shenanigans without obvious traces. But the UX could be better, for example this is what publishing a new version looks like [2]. I guess we can always build a separate UI.