I will autocorrect myself, this is how it should work, and that's how the spec was designed (mentioned also on: T14079#249898).
Our current implementation seems to have taken the lazy way and just try to link to the git repo (which would fail in other occasions). So while this is definitely a bug we should correct, but I stand by my earlier point: it won't link directly to the git repo

@ognarb the image will not be linked by the repository, that would break CORS settings. As I wrote above, the image will only be referenced as a relative path starting from the repository root, whoever will provide a catalog will host the images independently.

In T14079#249900, @ruphy wrote:

That would kind of be against the specification; it is not enforced as of now, but it wouldn't be a good precedent. I'd like to avoid it if at all possible. Can't we just list one or more of the current official maintainers? These names tend to be in the "About" page of the application, and we could use the main mailing list as contact point.

To answer a few more points....

I have made the necessary changes to the publiccode.yml file and committed them to master. I did not validate them yet but they should be picked up tonight when the crawler rebuilds the catalog

@ltoscano the catalog does not embed the pictures from other resources (which would be problematic with CORS).