[Feature Request + Question] Vendored mode has been automatically enabled

[sidkshatriya]

I'm trying to build opam from scratch. When I run ./configure --prefix=... I get the following message:

Downloading vendored dependencies... done
Extracting vendored dependencies... done

There is no other information presented. What exactly is being downloaded and from where? How is it being downloaded (e.g. via http or https, is it checksummed?)

What are these vendored dependencies? Are they binaries? Source code?

I'll also try explore the scripts and find out for myself but I'd greatly appreciate if anyone can answer the above questions if they get a chance.

My feature request for opam developers would be to present more detailed information to the end user relating to this vendoring (as configure executes). This will improve transparency and confidence in the compilation process of opam.

[sidkshatriya]

I'm noticing that a lot of these vendored dependencies are going into ./src_ext

[dra27]

It is indeed downloading source dependencies to src_ext/. I've opened #5277 which explains what's happening a bit more clearly.

When compiling an official release from a source tarball, the source tarballs are included with it, so the download stage doesn't actually perform any network access.

[sidkshatriya]

Thanks for looking at this so promptly! I was trying to compile from the master branch btw and not a tarball.

It would also be great for the download process to be a bit more verbose (if you're doing this in a shell script, even a set -x would work!). It would be useful to know which URLs are being hit and any checksum verification being done.

[kit-ty-kate]

@sidkshatriya I added a commit to #5277, this should now be verbose enough