This should be `remote`, but I can quickly fix that after merging the patch.

I think we can make "at least HTTP urls must be supported" and "only HTTP urls are supported", because that is much more precise and leaves no room for people reading the spec to speculate which other weird protocols we might support.

Make that "may" a "should".

Those restrictions are appstream-builder specific, I guess - the `local` type explicitly makes no restrictions for where icons are located, it could be anywhere on the filesystem. The appstream-generator tool deals with them whereever they are. For the paths you mention, `stock` is the better solution anyway. In general, using `local` is discouraged, `stock` is almost always the better option.