<div dir="ltr"><div>Very happy this is coming! I really like the details of this proposal as well.</div><div><br></div><div>Just one thing - having the `VersionLocks` in `Packages/VersionLocks` seems like a bad idea to me. Couple of hurdles right away</div><div>- for people who don't want to check in their dependencies, we can't just add `Packages` to our `.gitignore`, because that would make it impossible to check in the `VersionLocks` file (users would need to add exceptions to ignore Packages but keep the lockfile, which might result on users accidentally not committing their lockfile at all, which would defeat its whole purpose).</div><div>- `swift build --clean=dist` deletes the whole `Packages` directory, removing the lockfile, while I can imagine just wanting to delete and re-pull my dependencies with `swift build --clean=dist; swift build`. This will potentially generate a new lockfile, even though there was a completely valid one which I didn't explicitly say I want to overwrite. Again, we can add code to work around it, but needing to add so much exception code is a code smell to me.</div><div><br></div><div>The two points above are just the low-hanging fruit that came into my mind. I prefer the approach CocoaPods takes with `Podfile.lock` being next to the repo manifest, instead of in the `Pods` folder (which instead contains a `Manifest.lock` AFAIK). So does Rubygems and others.</div><div><br></div><div>For me, a regular troubleshooting step is removing the `Packages` and `.build` folders and rebuilding. In my opinion, this step should **not** include the risk of altering the locked dependency graph, because both folders are just "Derived Data", however the VersionLocks file is a source of truth. </div><div><br></div><div>And mixing source of truth with generated files feels very wrong to me.</div><div><br></div><div>I'm happy to be proven wrong, but I'd suggest to move the location of the lockfile next to `Package.swift`. Having it in `Packages` causes a couple of issues right away without bringing any tangible benefits as far as I can see (not to mention diverging from other package managers like CocoaPods and Rubygems, which all keep the lockfile next to their manifest files - and seem to be happy with it for years).</div><div><br></div><div>Honza</div><div><br></div><div><br></div></div><br><div class="gmail_quote"><div dir="ltr">On Fri, Mar 18, 2016 at 9:45 AM Ben Rimmington via swift-evolution <<a href="mailto:swift-evolution@swift.org">swift-evolution@swift.org</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="word-wrap:break-word"><div><div><<a href="https://github.com/apple/swift-package-manager/blob/master/Documentation/Internals/SwiftBasedManifestFormat.md#discussion" target="_blank">https://github.com/apple/swift-package-manager/blob/master/Documentation/Internals/SwiftBasedManifestFormat.md#discussion</a>></div><div><br></div><div><blockquote type="cite">We decided to use a Swift-based format for the manifest because we believe it gives developers the best experience for working with and describing their project. The primary alternative we considered was to use a declarative format encoded in a common data format like JSON. Although that would simplify implementation of the tooling around the manifest, it has the downside that users must then learn this additional language, and the development of high quality tools for that (documentation, syntax coloring, parsing diagnostics) isn't aligned with our goal of building great tools for Swift. In contrast, using the Swift language means that we can leverage all of the work on Swift to make those tools great.</blockquote></div><div><br></div><div>Could you generate a similar Swift-based format for the lockfile?</div><div><br></div><div>-- Ben</div></div></div><div style="word-wrap:break-word"><br><div><blockquote type="cite"><div>On 17 Mar 2016, at 18:23, Max Howell via swift-evolution <<a href="mailto:swift-evolution@swift.org" target="_blank">swift-evolution@swift.org</a>> wrote:</div><br><div><div style="word-wrap:break-word"><div>The following is a draft proposal, feedback welcome.</div><div><br></div><div>____________</div><div><h1 style="font-size:28px;margin:20px 0px 10px;padding:0px;font-family:Helvetica,arial,freesans,clean,sans-serif">SwiftPM Dependency Version Locking</h1><ul style="margin:15px 0px;padding-left:30px;color:rgb(51,51,51);font-family:Helvetica,arial,freesans,clean,sans-serif;font-size:14px"><li>Proposal: <a href="https://github.com/apple/swift-evolution/blob/master/proposals/NNNN-swiftpm-dependency-lockfiles.md" style="color:rgb(65,131,196);text-decoration:none" target="_blank">SE-NNNN</a></li><li>Author(s): <a href="https://github.com/aciidb0mb3r" style="color:rgb(65,131,196);text-decoration:none" target="_blank">Ankit Agarwal</a>, <a href="https://github.com/mxcl" style="color:rgb(65,131,196);text-decoration:none" target="_blank">Max Howell</a></li><li>Status: <strong>Discussion</strong></li><li>Review manager: Rick Ballard</li></ul><h2 style="font-size:24px;margin:20px 0px 10px;padding:0px;border-bottom-width:1px;border-bottom-style:solid;border-bottom-color:rgb(204,204,204);font-family:Helvetica,arial,freesans,clean,sans-serif">Introduction</h2><p style="font-size:14px;margin:0px 0px 15px;padding:0px;color:rgb(51,51,51);font-family:Helvetica,arial,freesans,clean,sans-serif">This proposal seeks to declare a new, generated file <code style="margin:0px 2px;padding:0px 5px;border:1px solid rgb(234,234,234);background-color:rgb(248,248,248);border-top-left-radius:3px;border-top-right-radius:3px;border-bottom-right-radius:3px;border-bottom-left-radius:3px;white-space:nowrap;font-size:12px;font-family:Consolas,'Liberation Mono',Courier,monospace">Packages/VersionLocks.json</code> that describes the exact state of a package’s dependency graph and then by default will be respected when executing most package manager commands. Thus it is considered a “version lock” for a package’s dependency sources.</p><p style="font-size:14px;margin:15px 0px;padding:0px;color:rgb(51,51,51);font-family:Helvetica,arial,freesans,clean,sans-serif"><a href="https://lists.swift.org/pipermail/swift-build-dev/Week-of-Mon-20151214/000067.html" style="color:rgb(65,131,196);text-decoration:none" target="_blank">Swift-evolution thread</a></p><h2 style="font-size:24px;margin:20px 0px 10px;padding:0px;border-bottom-width:1px;border-bottom-style:solid;border-bottom-color:rgb(204,204,204);font-family:Helvetica,arial,freesans,clean,sans-serif">Terminology</h2><ul style="margin:15px 0px;padding-left:30px;color:rgb(51,51,51);font-family:Helvetica,arial,freesans,clean,sans-serif;font-size:14px"><li>A <em>package</em> refers to a published, versioned git repository designed to be consumed as a dependency by SwiftPM.</li><li>A <em>project</em> refers to an end-user workspace that uses SwiftPM (via a <code style="margin:0px 2px;padding:0px 5px;border:1px solid rgb(234,234,234);background-color:rgb(248,248,248);border-top-left-radius:3px;border-top-right-radius:3px;border-bottom-right-radius:3px;border-bottom-left-radius:3px;white-space:nowrap;font-size:12px;font-family:Consolas,'Liberation Mono',Courier,monospace">Package.swift</code> and <code style="margin:0px 2px;padding:0px 5px;border:1px solid rgb(234,234,234);background-color:rgb(248,248,248);border-top-left-radius:3px;border-top-right-radius:3px;border-bottom-right-radius:3px;border-bottom-left-radius:3px;white-space:nowrap;font-size:12px;font-family:Consolas,'Liberation Mono',Courier,monospace">swift build</code>) fetching and building packages as part of its build</li></ul><p style="font-size:14px;margin:15px 0px;padding:0px;color:rgb(51,51,51);font-family:Helvetica,arial,freesans,clean,sans-serif">Describing this distinction is required because both the above have the same form, but are used differently by an end-user. An end-user may publish packages, but will eventually consume those packages in a project.</p><p style="font-size:14px;margin:15px 0px;padding:0px;color:rgb(51,51,51);font-family:Helvetica,arial,freesans,clean,sans-serif">As justification for this confusion, it is considered a feature that projects can easily and trivially become packages when using SwiftPM. Encouraging a vibrant packaging ecosystem is one of our goals.</p><h2 style="font-size:24px;margin:20px 0px 10px;padding:0px;border-bottom-width:1px;border-bottom-style:solid;border-bottom-color:rgb(204,204,204);font-family:Helvetica,arial,freesans,clean,sans-serif">Motivation</h2><p style="font-size:14px;margin:0px 0px 15px;padding:0px;color:rgb(51,51,51);font-family:Helvetica,arial,freesans,clean,sans-serif">In a vibrant packaging ecosystem, dependencies update continuously with bug-fixes and new features. A development team needs:</p><ol style="margin:15px 0px;padding-left:30px;color:rgb(51,51,51);font-family:Helvetica,arial,freesans,clean,sans-serif;font-size:14px"><li>To ensure they are all using the same versions of their dependencies for any given version-control commit.</li><li>Ensure they are all using the same versions of the underlying Swift toolchain</li><li>Be able to override or modify dependency specifications for the whole team for specific commits.</li></ol><p style="font-size:14px;margin:15px 0px;padding:0px;color:rgb(51,51,51);font-family:Helvetica,arial,freesans,clean,sans-serif">Currently with SwiftPM it is possible to fulfill <em>1.</em> by committing the sources of a package’s dependencies with the package itself, but this is not always desirable. There is no way to achieve 2. and 3. with SwiftPM alone.</p><p style="font-size:14px;margin:15px 0px;padding:0px;color:rgb(51,51,51);font-family:Helvetica,arial,freesans,clean,sans-serif">Additionally, there is not currently a way to know which version of Swift a package requires to build. At this time this situation is particularly precarious because Swift itself is not backwards compatible. As a Swift developer at the very least recording which Swift version a package was built with by the package developer is essential information in order to assess a package's suitability. Practically the package manager could in the future use this information to aid an end-user or even fix the problem when packages fail to compile.</p><h2 style="font-size:24px;margin:20px 0px 10px;padding:0px;border-bottom-width:1px;border-bottom-style:solid;border-bottom-color:rgb(204,204,204);font-family:Helvetica,arial,freesans,clean,sans-serif">Proposed Solution</h2><p style="font-size:14px;margin:0px 0px 15px;padding:0px;color:rgb(51,51,51);font-family:Helvetica,arial,freesans,clean,sans-serif">A file: <code style="margin:0px 2px;padding:0px 5px;border:1px solid rgb(234,234,234);background-color:rgb(248,248,248);border-top-left-radius:3px;border-top-right-radius:3px;border-bottom-right-radius:3px;border-bottom-left-radius:3px;white-space:nowrap;font-size:12px;font-family:Consolas,'Liberation Mono',Courier,monospace">Packages/VersionLocks.json</code> will be created alongside the Package.swift file. Its contents will describe:</p><ul style="margin:15px 0px;padding-left:30px;color:rgb(51,51,51);font-family:Helvetica,arial,freesans,clean,sans-serif;font-size:14px"><li>The URL and versions of cloned dependencies</li><li>An inline diff of any <em>local</em> modifications made to those packages relative to their pristine cloned states</li><li>The exact version of the Swift toolchain used as part of the last successful build of the package</li></ul><p style="font-size:14px;margin:15px 0px;padding:0px;color:rgb(51,51,51);font-family:Helvetica,arial,freesans,clean,sans-serif">This file is generated by SwiftPM.</p><p style="font-size:14px;margin:15px 0px;padding:0px;color:rgb(51,51,51);font-family:Helvetica,arial,freesans,clean,sans-serif">This file <em>should</em> be checked-in with projects.</p><p style="font-size:14px;margin:15px 0px;padding:0px;color:rgb(51,51,51);font-family:Helvetica,arial,freesans,clean,sans-serif">This file is <em>generated</em> and should not be edited by users. If the file is edited by users the behavior is undefined.</p><p style="font-size:14px;margin:15px 0px;padding:0px;color:rgb(51,51,51);font-family:Helvetica,arial,freesans,clean,sans-serif">This file <em>should</em> be checked-in with packages designed for consumption in projects, <em>however</em> SwiftPM will not use the checkout files of dependencies when determining a project’s dependency graph (this would make dependency graphs much less likely to resolve due to overly strict versioning requirements). In the future we may choose to make it possible for end-users to attempt to build a package using all checkout files since in certain deployment scenarios where an exact graph has already been tested, this is a solid reliabiity feature.</p><p style="font-size:14px;margin:15px 0px;padding:0px;color:rgb(51,51,51);font-family:Helvetica,arial,freesans,clean,sans-serif">Any local, modifications made to the clones in <code style="margin:0px 2px;padding:0px 5px;border:1px solid rgb(234,234,234);background-color:rgb(248,248,248);border-top-left-radius:3px;border-top-right-radius:3px;border-bottom-right-radius:3px;border-bottom-left-radius:3px;white-space:nowrap;font-size:12px;font-family:Consolas,'Liberation Mono',Courier,monospace">Packages</code> are recorded in <code style="margin:0px 2px;padding:0px 5px;border:1px solid rgb(234,234,234);background-color:rgb(248,248,248);border-top-left-radius:3px;border-top-right-radius:3px;border-bottom-right-radius:3px;border-bottom-left-radius:3px;white-space:nowrap;font-size:12px;font-family:Consolas,'Liberation Mono',Courier,monospace">Packages/VersionLocks.json</code> as part of the flow described in the next section. Modifications here means: changes to git remotes and the git-ref of the checked-out HEAD.</p><h2 style="font-size:24px;margin:20px 0px 10px;padding:0px;border-bottom-width:1px;border-bottom-style:solid;border-bottom-color:rgb(204,204,204);font-family:Helvetica,arial,freesans,clean,sans-serif">Detailed Design</h2><p style="font-size:14px;margin:0px 0px 15px;padding:0px;color:rgb(51,51,51);font-family:Helvetica,arial,freesans,clean,sans-serif">In a fresh clone that does not contain a <code style="margin:0px 2px;padding:0px 5px;border:1px solid rgb(234,234,234);background-color:rgb(248,248,248);border-top-left-radius:3px;border-top-right-radius:3px;border-bottom-right-radius:3px;border-bottom-left-radius:3px;white-space:nowrap;font-size:12px;font-family:Consolas,'Liberation Mono',Courier,monospace">Packages</code> directory <code style="margin:0px 2px;padding:0px 5px;border:1px solid rgb(234,234,234);background-color:rgb(248,248,248);border-top-left-radius:3px;border-top-right-radius:3px;border-bottom-right-radius:3px;border-bottom-left-radius:3px;white-space:nowrap;font-size:12px;font-family:Consolas,'Liberation Mono',Courier,monospace">swift build</code> will determine the dependency graph, clone the packages into <code style="margin:0px 2px;padding:0px 5px;border:1px solid rgb(234,234,234);background-color:rgb(248,248,248);border-top-left-radius:3px;border-top-right-radius:3px;border-bottom-right-radius:3px;border-bottom-left-radius:3px;white-space:nowrap;font-size:12px;font-family:Consolas,'Liberation Mono',Courier,monospace">Packages</code> and generate a <code style="margin:0px 2px;padding:0px 5px;border:1px solid rgb(234,234,234);background-color:rgb(248,248,248);border-top-left-radius:3px;border-top-right-radius:3px;border-bottom-right-radius:3px;border-bottom-left-radius:3px;white-space:nowrap;font-size:12px;font-family:Consolas,'Liberation Mono',Courier,monospace">Packages/VersionLocks.json</code> file.</p><p style="font-size:14px;margin:15px 0px;padding:0px;color:rgb(51,51,51);font-family:Helvetica,arial,freesans,clean,sans-serif">The user can now step into the Packages directory and modify package sources. If the user then runs <code style="margin:0px 2px;padding:0px 5px;border:1px solid rgb(234,234,234);background-color:rgb(248,248,248);border-top-left-radius:3px;border-top-right-radius:3px;border-bottom-right-radius:3px;border-bottom-left-radius:3px;white-space:nowrap;font-size:12px;font-family:Consolas,'Liberation Mono',Courier,monospace">swift build</code> again the package manager will error out:</p><pre style="margin-top:15px;margin-bottom:15px;background-color:rgb(248,248,248);border:1px solid rgb(204,204,204);font-size:12px;line-height:19px;overflow:auto;padding:6px 10px;border-top-left-radius:3px;border-top-right-radius:3px;border-bottom-right-radius:3px;border-bottom-left-radius:3px;font-family:Consolas,'Liberation Mono',Courier,monospace;color:rgb(51,51,51)"><code style="margin:0px;padding:0px;border:none;background-color:transparent;border-top-left-radius:3px;border-top-right-radius:3px;border-bottom-right-radius:3px;border-bottom-left-radius:3px;font-family:Consolas,'Liberation Mono',Courier,monospace">error: dependency sources have been modified
execute `swift build --lock` or `swift build --ignore-lock`</code></pre><p style="font-size:14px;margin:15px 0px;padding:0px;color:rgb(51,51,51);font-family:Helvetica,arial,freesans,clean,sans-serif">It is an error to build against an unlocked dependency graph, but to facilitate fixing bugs etc. an ignore flag can be specified.</p><p style="font-size:14px;margin:15px 0px;padding:0px;color:rgb(51,51,51);font-family:Helvetica,arial,freesans,clean,sans-serif">When <code style="margin:0px 2px;padding:0px 5px;border:1px solid rgb(234,234,234);background-color:rgb(248,248,248);border-top-left-radius:3px;border-top-right-radius:3px;border-bottom-right-radius:3px;border-bottom-left-radius:3px;white-space:nowrap;font-size:12px;font-family:Consolas,'Liberation Mono',Courier,monospace">swift build --lock</code> is specified the package manager regenerates the lockfile detailing the active git remote and the SHA that is checked-out.</p><p style="font-size:14px;margin:15px 0px;padding:0px;color:rgb(51,51,51);font-family:Helvetica,arial,freesans,clean,sans-serif">Every time <code style="margin:0px 2px;padding:0px 5px;border:1px solid rgb(234,234,234);background-color:rgb(248,248,248);border-top-left-radius:3px;border-top-right-radius:3px;border-bottom-right-radius:3px;border-bottom-left-radius:3px;white-space:nowrap;font-size:12px;font-family:Consolas,'Liberation Mono',Courier,monospace">swift build</code> completes a build the lockfile is updated (if necessary) recording the current version of the Swift toolchain that achieved the build.</p><h3 style="font-size:18px;margin:20px 0px 10px;padding:0px;color:rgb(51,51,51);font-family:Helvetica,arial,freesans,clean,sans-serif"><code style="margin:0px 2px;padding:0px 5px;border:1px solid rgb(234,234,234);background-color:rgb(248,248,248);border-top-left-radius:3px;border-top-right-radius:3px;border-bottom-right-radius:3px;border-bottom-left-radius:3px;white-space:nowrap;font-size:inherit;font-family:Consolas,'Liberation Mono',Courier,monospace">Packages/VersionLocks.json</code></h3><p style="font-size:14px;margin:0px 0px 15px;padding:0px;color:rgb(51,51,51);font-family:Helvetica,arial,freesans,clean,sans-serif">The exact design of the contents of this file will be explored during iterative development, but here is a possible example:</p><p style="font-size:14px;margin:15px 0px;padding:0px;color:rgb(51,51,51);font-family:Helvetica,arial,freesans,clean,sans-serif"><code style="margin:0px 2px;padding:0px 5px;border:1px solid rgb(234,234,234);background-color:rgb(248,248,248);border-top-left-radius:3px;border-top-right-radius:3px;border-bottom-right-radius:3px;border-bottom-left-radius:3px;white-space:nowrap;font-size:12px;font-family:Consolas,'Liberation Mono',Courier,monospace">json { "packages": [ { "clone": "Packages/PromiseKit-3.0.3", "origin": "<a href="https://github.com/mxcl/PromiseKit" target="_blank">https://github.com/mxcl/PromiseKit</a>" "ref": "3.0.3" }, { "clone": "Packages/Alamofire-1.2.3", "origin": "<a href="https://github.com/a-fork-somewhere/Alamofire" target="_blank">https://github.com/a-fork-somewhere/Alamofire</a>" "ref": "crucial-fix" }, { "clone": "Packages/Quick-1.2.3", "origin": "<a href="https://github.com/Quick/Quick" target="_blank">https://github.com/Quick/Quick</a>" "ref": "1.2.3" } ] }</code></p><h3 style="font-size:18px;margin:20px 0px 10px;padding:0px;color:rgb(51,51,51);font-family:Helvetica,arial,freesans,clean,sans-serif">Workflow — Regular Build</h3><ol style="margin:15px 0px;padding-left:30px;color:rgb(51,51,51);font-family:Helvetica,arial,freesans,clean,sans-serif;font-size:14px"><li>User runs <code style="margin:0px 2px;padding:0px 5px;border:1px solid rgb(234,234,234);background-color:rgb(248,248,248);border-top-left-radius:3px;border-top-right-radius:3px;border-bottom-right-radius:3px;border-bottom-left-radius:3px;white-space:nowrap;font-size:12px;font-family:Consolas,'Liberation Mono',Courier,monospace">swift build</code></li><li>If <code style="margin:0px 2px;padding:0px 5px;border:1px solid rgb(234,234,234);background-color:rgb(248,248,248);border-top-left-radius:3px;border-top-right-radius:3px;border-bottom-right-radius:3px;border-bottom-left-radius:3px;white-space:nowrap;font-size:12px;font-family:Consolas,'Liberation Mono',Courier,monospace">Packages/</code> contains clones and a <code style="margin:0px 2px;padding:0px 5px;border:1px solid rgb(234,234,234);background-color:rgb(248,248,248);border-top-left-radius:3px;border-top-right-radius:3px;border-bottom-right-radius:3px;border-bottom-left-radius:3px;white-space:nowrap;font-size:12px;font-family:Consolas,'Liberation Mono',Courier,monospace">VersionLocks.json</code>SwiftPM skips to 7.</li><li>If <code style="margin:0px 2px;padding:0px 5px;border:1px solid rgb(234,234,234);background-color:rgb(248,248,248);border-top-left-radius:3px;border-top-right-radius:3px;border-bottom-right-radius:3px;border-bottom-left-radius:3px;white-space:nowrap;font-size:12px;font-family:Consolas,'Liberation Mono',Courier,monospace">Packages/</code> contains clones and no <code style="margin:0px 2px;padding:0px 5px;border:1px solid rgb(234,234,234);background-color:rgb(248,248,248);border-top-left-radius:3px;border-top-right-radius:3px;border-bottom-right-radius:3px;border-bottom-left-radius:3px;white-space:nowrap;font-size:12px;font-family:Consolas,'Liberation Mono',Courier,monospace">VersionLocks.json</code> the lockfile is generated from the clones</li><li>If <code style="margin:0px 2px;padding:0px 5px;border:1px solid rgb(234,234,234);background-color:rgb(248,248,248);border-top-left-radius:3px;border-top-right-radius:3px;border-bottom-right-radius:3px;border-bottom-left-radius:3px;white-space:nowrap;font-size:12px;font-family:Consolas,'Liberation Mono',Courier,monospace">Packages/</code> contains checked out sources without git information and no <code style="margin:0px 2px;padding:0px 5px;border:1px solid rgb(234,234,234);background-color:rgb(248,248,248);border-top-left-radius:3px;border-top-right-radius:3px;border-bottom-right-radius:3px;border-bottom-left-radius:3px;white-space:nowrap;font-size:12px;font-family:Consolas,'Liberation Mono',Courier,monospace">VersionLocks.json</code> SwiftPM fetches the git information and provided there is no diff, generates the Lockfile, if there is variation it is an error *</li><li>If <code style="margin:0px 2px;padding:0px 5px;border:1px solid rgb(234,234,234);background-color:rgb(248,248,248);border-top-left-radius:3px;border-top-right-radius:3px;border-bottom-right-radius:3px;border-bottom-left-radius:3px;white-space:nowrap;font-size:12px;font-family:Consolas,'Liberation Mono',Courier,monospace">Packages/VersionLocks.json</code> is present its dependency graph is used</li><li>If <code style="margin:0px 2px;padding:0px 5px;border:1px solid rgb(234,234,234);background-color:rgb(248,248,248);border-top-left-radius:3px;border-top-right-radius:3px;border-bottom-right-radius:3px;border-bottom-left-radius:3px;white-space:nowrap;font-size:12px;font-family:Consolas,'Liberation Mono',Courier,monospace">Packages</code> doesn't exist or is empty the dependency graph is resolved, packages are cloned and the Lockfile is generated</li><li><p style="font-size:1em;margin:15px 0px;padding:0px">Build, if <code style="margin:0px 2px;padding:0px 5px;border:1px solid rgb(234,234,234);background-color:rgb(248,248,248);border-top-left-radius:3px;border-top-right-radius:3px;border-bottom-right-radius:3px;border-bottom-left-radius:3px;white-space:nowrap;font-size:12px;font-family:Consolas,'Liberation Mono',Courier,monospace">Packages</code> are missing because we skipped from 2. the build will error, it is the user's responsibility to instruct SwiftPM to <code style="margin:0px 2px;padding:0px 5px;border:1px solid rgb(234,234,234);background-color:rgb(248,248,248);border-top-left-radius:3px;border-top-right-radius:3px;border-bottom-right-radius:3px;border-bottom-left-radius:3px;white-space:nowrap;font-size:12px;font-family:Consolas,'Liberation Mono',Courier,monospace">--update</code> or to fix their dependency graph some other way.</p><ul style="margin:15px 0px 0px;padding-left:30px"><li><p style="font-size:1em;margin:15px 0px;padding:0px">This scenario is so users can check in their complete dependency sources to their tree instead of / as well as the <code style="margin:0px 2px;padding:0px 5px;border:1px solid rgb(234,234,234);background-color:rgb(248,248,248);border-top-left-radius:3px;border-top-right-radius:3px;border-bottom-right-radius:3px;border-bottom-left-radius:3px;white-space:nowrap;font-size:12px;font-family:Consolas,'Liberation Mono',Courier,monospace">VersionLocks.json</code> file: a situation which sometimes is necessary if your dependencies are removed from their third party online location, etc.</p></li></ul></li></ol><h3 style="font-size:18px;margin:20px 0px 10px;padding:0px;color:rgb(51,51,51);font-family:Helvetica,arial,freesans,clean,sans-serif">Workflow — Making Modifications</h3><ol style="margin:15px 0px;padding-left:30px;color:rgb(51,51,51);font-family:Helvetica,arial,freesans,clean,sans-serif;font-size:14px"><li>User makes local modification to a dependency’s sources</li><li>User runs <code style="margin:0px 2px;padding:0px 5px;border:1px solid rgb(234,234,234);background-color:rgb(248,248,248);border-top-left-radius:3px;border-top-right-radius:3px;border-bottom-right-radius:3px;border-bottom-left-radius:3px;white-space:nowrap;font-size:12px;font-family:Consolas,'Liberation Mono',Courier,monospace">swift build</code></li><li><code style="margin:0px 2px;padding:0px 5px;border:1px solid rgb(234,234,234);background-color:rgb(248,248,248);border-top-left-radius:3px;border-top-right-radius:3px;border-bottom-right-radius:3px;border-bottom-left-radius:3px;white-space:nowrap;font-size:12px;font-family:Consolas,'Liberation Mono',Courier,monospace">swift build</code> errors out.</li><li>User must either lock the graph or run with <code style="margin:0px 2px;padding:0px 5px;border:1px solid rgb(234,234,234);background-color:rgb(248,248,248);border-top-left-radius:3px;border-top-right-radius:3px;border-bottom-right-radius:3px;border-bottom-left-radius:3px;white-space:nowrap;font-size:12px;font-family:Consolas,'Liberation Mono',Courier,monospace">--ignore-lock</code></li></ol><p style="font-size:14px;margin:15px 0px;padding:0px;color:rgb(51,51,51);font-family:Helvetica,arial,freesans,clean,sans-serif">The error-out is likely to be considered tedious by users, however we consider it important that users are made aware and forced to act when they modify their dependencies and thus are exposing their team/users to so-called “dependency hell”.</p><p style="font-size:14px;margin:15px 0px;padding:0px;color:rgb(51,51,51);font-family:Helvetica,arial,freesans,clean,sans-serif">Runing <code style="margin:0px 2px;padding:0px 5px;border:1px solid rgb(234,234,234);background-color:rgb(248,248,248);border-top-left-radius:3px;border-top-right-radius:3px;border-bottom-right-radius:3px;border-bottom-left-radius:3px;white-space:nowrap;font-size:12px;font-family:Consolas,'Liberation Mono',Courier,monospace">swift build --lock</code> regenerates the lockfile, but does not build.</p><p style="font-size:14px;margin:15px 0px;padding:0px;color:rgb(51,51,51);font-family:Helvetica,arial,freesans,clean,sans-serif">Modifications must be committed. This means that if the modifications are not uploaded to a location accessible to the rest of the team they will fail to build when they update their checkouts.</p><p style="font-size:14px;margin:15px 0px;padding:0px;color:rgb(51,51,51);font-family:Helvetica,arial,freesans,clean,sans-serif">The package manager could check for this by asking git if the specified origin has the current locked ref and error out as appropriate.</p><h3 style="font-size:18px;margin:20px 0px 10px;padding:0px;color:rgb(51,51,51);font-family:Helvetica,arial,freesans,clean,sans-serif">Workflow — Overriding Packages</h3><ol style="margin:15px 0px;padding-left:30px;color:rgb(51,51,51);font-family:Helvetica,arial,freesans,clean,sans-serif;font-size:14px"><li>User steps into a Package directory eg. <code style="margin:0px 2px;padding:0px 5px;border:1px solid rgb(234,234,234);background-color:rgb(248,248,248);border-top-left-radius:3px;border-top-right-radius:3px;border-bottom-right-radius:3px;border-bottom-left-radius:3px;white-space:nowrap;font-size:12px;font-family:Consolas,'Liberation Mono',Courier,monospace">Packages/Foo-1.2.3</code></li><li>User changes the <code style="margin:0px 2px;padding:0px 5px;border:1px solid rgb(234,234,234);background-color:rgb(248,248,248);border-top-left-radius:3px;border-top-right-radius:3px;border-bottom-right-radius:3px;border-bottom-left-radius:3px;white-space:nowrap;font-size:12px;font-family:Consolas,'Liberation Mono',Courier,monospace">origin</code> of <code style="margin:0px 2px;padding:0px 5px;border:1px solid rgb(234,234,234);background-color:rgb(248,248,248);border-top-left-radius:3px;border-top-right-radius:3px;border-bottom-right-radius:3px;border-bottom-left-radius:3px;white-space:nowrap;font-size:12px;font-family:Consolas,'Liberation Mono',Courier,monospace">Foo</code> to their own fork</li><li>User alters HEAD to point to a fix in their own fork</li><li><code style="margin:0px 2px;padding:0px 5px;border:1px solid rgb(234,234,234);background-color:rgb(248,248,248);border-top-left-radius:3px;border-top-right-radius:3px;border-bottom-right-radius:3px;border-bottom-left-radius:3px;white-space:nowrap;font-size:12px;font-family:Consolas,'Liberation Mono',Courier,monospace">swift build</code> errors out.</li><li>User must either lock the graph or run with <code style="margin:0px 2px;padding:0px 5px;border:1px solid rgb(234,234,234);background-color:rgb(248,248,248);border-top-left-radius:3px;border-top-right-radius:3px;border-bottom-right-radius:3px;border-bottom-left-radius:3px;white-space:nowrap;font-size:12px;font-family:Consolas,'Liberation Mono',Courier,monospace">--ignore-lock</code></li></ol><p style="font-size:14px;margin:15px 0px;padding:0px;color:rgb(51,51,51);font-family:Helvetica,arial,freesans,clean,sans-serif">Running <code style="margin:0px 2px;padding:0px 5px;border:1px solid rgb(234,234,234);background-color:rgb(248,248,248);border-top-left-radius:3px;border-top-right-radius:3px;border-bottom-right-radius:3px;border-bottom-left-radius:3px;white-space:nowrap;font-size:12px;font-family:Consolas,'Liberation Mono',Courier,monospace">swift build --lock</code> regenerates the lockfile, the new origin and tag is stored. Thus a fresh clone of this project would use these overrides.</p><p style="font-size:14px;margin:15px 0px;padding:0px;color:rgb(51,51,51);font-family:Helvetica,arial,freesans,clean,sans-serif">It is important to note that this workflow will not be respected for dependencies, only for projects.</p><p style="font-size:14px;margin:15px 0px;padding:0px;color:rgb(51,51,51);font-family:Helvetica,arial,freesans,clean,sans-serif">If a package author requires an override they have a few options:</p><ol style="margin:15px 0px;padding-left:30px;color:rgb(51,51,51);font-family:Helvetica,arial,freesans,clean,sans-serif;font-size:14px"><li>Change the <code style="margin:0px 2px;padding:0px 5px;border:1px solid rgb(234,234,234);background-color:rgb(248,248,248);border-top-left-radius:3px;border-top-right-radius:3px;border-bottom-right-radius:3px;border-bottom-left-radius:3px;white-space:nowrap;font-size:12px;font-family:Consolas,'Liberation Mono',Courier,monospace">Package.swift</code> dependency specification. This should only be done as a last resort, for example, a critical bug must be fixed in a dependency and that dependency author is not being responsive. It is up to the Package author to ensure this scenario goes well. SwiftPM itself wants to guard against these conditions with our proposed “publish & lint” step that validates such decisions before signing a published package tag. But we are not there yet and thus package authors should be responsible.</li><li>Advise end-users in a package README that they should override the dependency themselves.</li></ol><p style="font-size:14px;margin:15px 0px;padding:0px;color:rgb(51,51,51);font-family:Helvetica,arial,freesans,clean,sans-serif"><em>2</em> is preferred, but <em>1</em> will happen. We consider it our responsibility to develop tooling that makes <em>1.</em> safe or unnecessary, but we are not there yet.</p><h3 style="font-size:18px;margin:20px 0px 10px;padding:0px;color:rgb(51,51,51);font-family:Helvetica,arial,freesans,clean,sans-serif">Workflow — Updating Packages</h3><p style="font-size:14px;margin:0px 0px 15px;padding:0px;color:rgb(51,51,51);font-family:Helvetica,arial,freesans,clean,sans-serif">SwiftPM has no update mechanism yet, but once it does running <code style="margin:0px 2px;padding:0px 5px;border:1px solid rgb(234,234,234);background-color:rgb(248,248,248);border-top-left-radius:3px;border-top-right-radius:3px;border-bottom-right-radius:3px;border-bottom-left-radius:3px;white-space:nowrap;font-size:12px;font-family:Consolas,'Liberation Mono',Courier,monospace">swift build --update</code> will fetch the latest versions of all dependencies and update the lockfile.</p><h2 style="font-size:24px;margin:20px 0px 10px;padding:0px;border-bottom-width:1px;border-bottom-style:solid;border-bottom-color:rgb(204,204,204);font-family:Helvetica,arial,freesans,clean,sans-serif">Impact on existing code</h2><p style="font-size:14px;margin:0px 0px 15px;padding:0px;color:rgb(51,51,51);font-family:Helvetica,arial,freesans,clean,sans-serif">This proposal will have no impact on existing code.</p><h2 style="font-size:24px;margin:20px 0px 10px;padding:0px;border-bottom-width:1px;border-bottom-style:solid;border-bottom-color:rgb(204,204,204);font-family:Helvetica,arial,freesans,clean,sans-serif">Alternatives Considered</h2><p style="font-size:14px;margin:0px 0px 15px;padding:0px;color:rgb(51,51,51);font-family:Helvetica,arial,freesans,clean,sans-serif">One alternative is to allow mentioning refs in manifest file while declaring a dependency but as discussed in <a href="http://markdownlivepreview.com/%22https://lists.swift.org/pipermail/swift-build-dev/Week-of-Mon-20151214/" style="color:rgb(65,131,196);text-decoration:none" target="_blank">this</a> thread it might not be the best idea.</p><p style="font-size:14px;margin:15px 0px;padding:0px;color:rgb(51,51,51);font-family:Helvetica,arial,freesans,clean,sans-serif">Using Git submodules for this feature was considered. However something additionally would be required to specify swift version and record local diffs. Also this would lock us into git, and despite the fact that currently we only use git, we have not yet ruled out supporting other version control systems.</p></div></div></div></blockquote></div><br></div><div style="word-wrap:break-word"></div>_______________________________________________<br>
swift-evolution mailing list<br>
<a href="mailto:swift-evolution@swift.org" target="_blank">swift-evolution@swift.org</a><br>
<a href="https://lists.swift.org/mailman/listinfo/swift-evolution" rel="noreferrer" target="_blank">https://lists.swift.org/mailman/listinfo/swift-evolution</a><br>
</blockquote></div>