Package Manager Source Archive Dependencies

[yim_lee]

I can see how non-binary source archive support in SwiftPM would share same plumbing as package registry's download functionality, but I am not sure adding source archive dependency to package manifest is the necessary intermediate step.

Here is how I envision integration between SwiftPM and package registry would work. Suppose this is how we declare a dependency served by package registry:

dependencies: [
    .package(id: "github.com/mona/LinkedList", from: "1.0.0"),
]

After using package registry API(s) to resolve to the correct version 1.2.0, SwiftPM downloads the source archive for github.com/mona/LinkedList version 1.2.0 from package registry. Package registry provides the archive and checksum, etc. which SwiftPM needs to verify (per Swift Package Registry Service - Security proposal). Once authenticity is confirmed, SwiftPM can extract the source and use it as if it were a cloned Git repository.

So IMO SwiftPM would need to be able to work with non-binary source archive, but adding support for source archive dependency to package manifest is not required.

I also have questions on this:

@mattt

When publishing a source archive, the package's owner should provide the computed checksum alongside the Zip file to make it safer and easier for other developers to use it as a dependency. If a precomputed checksum isn't available, the developer is responsible to verifying the contents of the source archive and computing a checksum themselves.

I would think creating source archive and computing checksum should be done by package registry (or the "authority") rather than individual package owners, so if/when package registry becomes available it would take over the quoted process. Is that the assumption? Or, do we expect package registry to support some sort of upload API?