[v3] bake download lock file into releases

[henderkes]

that way we sidestep the issue where we need to push out releases to fix library update changes

[crazywhalecc]

This doesn't sound like a good idea for current architecture, but we might be able to mirror all downloads and bind them to the SPC binary release, so that SPC binaries only use mirror archives by default (git mode never uses mirror by default).

I'm not sure if it's a good idea to fix the source download link for the lockfile and have people download it again, but mirroring always ensures that people can download a usable package, thus achieving the same effect as repackaging the lockfile.

WDYT?

[crazywhalecc]

If we want to avoid updating the source code of the StaticPHP project itself and avoid releasing a new version, we might be able to completely separate the core registry, but that's another option and doesn't fundamentally solve the problem.

[henderkes]

Using mirrors is a bad idea because we want users to download from original sources as much as possible. Reproducible builds are also a very important thing that we currently (in v2) can't offer, but in v3 we will be able to. I think that will be of importance to downstream projects like @asgrim pie and obviously frankenphp too.

Users downloading say 3.0.0 should be able to run it now and in 10 years and get the exact same sources - if they want to update sources we have an explicit spc downloads update command that voids reproducibility and means we don't need to chase issues until we release a new version.

[asgrim]

Yeah supplying a lock file would be useful to avoid the dependency issues 🙏 would be a nice to have for us for sure, thank you for the ping!

[crazywhalecc]

We could first draft a plan, outlining some details on how to implement it. I have a lot of uncommitted and incomplete code locally, so I can quickly complete or review it later when I have time working on SPC.

[henderkes]

I think the plan is very simple and we already have 95% of the functionality implemented.

1. downloader writes url/git commit and download sha256 into lock file
2. with release, run download --all and add the lock file to the release tarball like php-src does with re2c and other generated files
3. the spc downloader, if seeing a lock file, it looks for the requested download in the lock file, if present, it downloads from same url/commit
4. if sha256 mismatch, warning
5. spc download <sources> --update fetches latest sources and locks them, overwriting old lock (I need this for spc-packages anyway)