Publish Elixir Semver requirement with each release

[jcspencer]

Currently the metadata.exs (soon to be an Erlang term file as of #41) does not contain the Elixir Semver version requirement (eg. "~> 0.15.0"). Once this is completed, it will most likely close both #26 and hexpm/hexpm#20. (This will also be used in hexpm/hexpm#25 to display version requirements on package pages)

If this is added, the Elixir version will be published with all future Hex packages in the tarball. However, for older Hex versions, we can simply traverse the Mix.exs file in the contents.tar.gz for the Elixir verion requirement.

Virtually, when resolving the package, we can run the following to check if the Elixir version matches the dependency:

requirement = "~> 0.15.1" # example
Elixir.System.version |> Version.match?(requirement)

If the version requirement does not match the current requirement, it will warn the user (toggle-able via command line flag) and possibly halt the installation (again, would be toggle-able via command line flag)

Older Hex versions would simply ignore the Elixir requirement in the metadata and continue to operate as usual.

If an admin could confirm this is the right direction for this issue, I'd be happy to put together a PR 👍

[ericmj]

It is not enough to put the version requirement in the metadata file. It needs to be in the registry so that we can access it during resolution. We also need to store it with the release as a new column in the database.

We already warn the user if the elixir requirement does not match for a dependency (Mix does this). The idea is to never resolve a package for which the requirement doesn't match. This can of course be overriden with override: true.

[jcspencer]

If we're adding it to the registry will it be backwards compatible with older versions of Hex due to the ETS table structure?

If we never resolve a package, how much warning do we give to the user that this has occurred? Writing to stderr? Killing the process with an exit code >0?

[ericmj]

If we're adding it to the registry will it be backwards compatible with older versions of Hex due to the ETS table structure?

It will be backwards compatible.

If we never resolve a package, how much warning do we give to the user that this has occurred? Writing to stderr? Killing the process with an exit code >0?

We say that dependency resolution failed and exit.

[ericmj]

The client now includes the elixir version requirement in the metadata when publishing, there is still lots to do. I will continue to track this in #26.