-
Notifications
You must be signed in to change notification settings - Fork 184
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Publish Elixir Semver requirement with each release #44
Comments
It is not enough to put the version requirement in the metadata file. It needs to be in the registry so that we can access it during resolution. We also need to store it with the release as a new column in the database. We already warn the user if the elixir requirement does not match for a dependency (Mix does this). The idea is to never resolve a package for which the requirement doesn't match. This can of course be overriden with |
If we're adding it to the registry will it be backwards compatible with older versions of Hex due to the ETS table structure? If we never resolve a package, how much warning do we give to the user that this has occurred? Writing to stderr? Killing the process with an exit code >0? |
It will be backwards compatible.
We say that dependency resolution failed and exit. |
The client now includes the elixir version requirement in the metadata when publishing, there is still lots to do. I will continue to track this in #26. |
hexpm#44 add tarpaulin support
Currently the
metadata.exs
(soon to be an Erlang term file as of #41) does not contain the Elixir Semver version requirement (eg."~> 0.15.0"
). Once this is completed, it will most likely close both #26 and hexpm/hexpm#20. (This will also be used in hexpm/hexpm#25 to display version requirements on package pages)If this is added, the Elixir version will be published with all future Hex packages in the tarball. However, for older Hex versions, we can simply traverse the
Mix.exs
file in the contents.tar.gz for the Elixir verion requirement.Virtually, when resolving the package, we can run the following to check if the Elixir version matches the dependency:
If the version requirement does not match the current requirement, it will warn the user (toggle-able via command line flag) and possibly halt the installation (again, would be toggle-able via command line flag)
Older Hex versions would simply ignore the Elixir requirement in the metadata and continue to operate as usual.
If an admin could confirm this is the right direction for this issue, I'd be happy to put together a PR 👍
The text was updated successfully, but these errors were encountered: