Problem
Some ports currently use vcpkg_from_git() to fetch their source code. Unlike archive-based source acquisition, this prevents the downloaded source from being stored and reused through the vcpkg asset cache.
A significant number of these ports fetch repositories hosted on GoogleSource. Although GoogleSource provides an archive endpoint, archives generated for the same commit are not guaranteed to produce a stable and byte-identical response. As a result, they cannot be reliably referenced using a fixed SHA512 checksum.
This leaves port maintainers with two undesirable options:
Use vcpkg_from_git(), which bypasses the asset cache and requires every build environment to clone the repository.
Use the GoogleSource archive endpoint and risk checksum changes even though the underlying commit has not changed.
The first option increases network traffic, makes offline or restricted-network builds more difficult, and reduces the effectiveness of binary and asset caching infrastructure. The second option is not sufficiently reproducible for vcpkg ports.
Proposal
Create an organization named vcpkg-mirrors(or other name) that contains automatically synchronized mirrors of upstream repositories whose original hosting service cannot provide stable source archives.
For example:
github.com/vcpkg-mirrors/<repository>
The name of the mirror repo can match the port name exactly.
An automated synchronization service could periodically fetch updates from the canonical upstream repository and push them to the corresponding mirror.
Ports could then use vcpkg_from_github():
vcpkg_from_github(
OUT_SOURCE_PATH SOURCE_PATH
REPO vcpkg-mirrors/repository
REF <upstream-commit>
SHA512 <stable-sha512>
)GitHub-generated archives for a mirrored commit would provide a practical, checksum-addressable source artifact that can be stored in the vcpkg asset cache.
Benefits
This would provide several benefits:
Source downloads could be handled by the vcpkg asset cache.
Builds would no longer need to perform full Git clones for these ports.
Downloaded sources would be reproducible and protected by SHA512 verification.
Offline and restricted-network build environments would work more reliably.
CI systems would consume less bandwidth and place less load on upstream Git servers.
Ports would use the same archive-based source acquisition workflow as most other vcpkg ports.
Existing ports using vcpkg_from_git() could be migrated incrementally.
Scope
The organization would not need to mirror every vcpkg dependency. It could initially be limited to repositories that meet criteria such as:
The upstream archive service does not return deterministic byte streams.
The port currently needs vcpkg_from_git() for this reason.
The upstream repository is stable enough to support automated mirroring.
The repository license permits redistribution through a public mirror.
GoogleSource-hosted dependencies would likely be the main initial use case.
Problem
Some ports currently use
vcpkg_from_git()to fetch their source code. Unlike archive-based source acquisition, this prevents the downloaded source from being stored and reused through the vcpkg asset cache.A significant number of these ports fetch repositories hosted on GoogleSource. Although GoogleSource provides an archive endpoint, archives generated for the same commit are not guaranteed to produce a stable and byte-identical response. As a result, they cannot be reliably referenced using a fixed SHA512 checksum.
This leaves port maintainers with two undesirable options:
Use
vcpkg_from_git(), which bypasses the asset cache and requires every build environment to clone the repository.Use the GoogleSource archive endpoint and risk checksum changes even though the underlying commit has not changed.
The first option increases network traffic, makes offline or restricted-network builds more difficult, and reduces the effectiveness of binary and asset caching infrastructure. The second option is not sufficiently reproducible for vcpkg ports.
Proposal
Create an organization named
vcpkg-mirrors(or other name) that contains automatically synchronized mirrors of upstream repositories whose original hosting service cannot provide stable source archives.For example:
github.com/vcpkg-mirrors/<repository>The name of the mirror repo can match the port name exactly.
An automated synchronization service could periodically fetch updates from the canonical upstream repository and push them to the corresponding mirror.
Ports could then use
vcpkg_from_github():GitHub-generated archives for a mirrored commit would provide a practical, checksum-addressable source artifact that can be stored in the vcpkg asset cache.
Benefits
This would provide several benefits:
Source downloads could be handled by the vcpkg asset cache.
Builds would no longer need to perform full Git clones for these ports.
Downloaded sources would be reproducible and protected by SHA512 verification.
Offline and restricted-network build environments would work more reliably.
CI systems would consume less bandwidth and place less load on upstream Git servers.
Ports would use the same archive-based source acquisition workflow as most other vcpkg ports.
Existing ports using
vcpkg_from_git()could be migrated incrementally.Scope
The organization would not need to mirror every vcpkg dependency. It could initially be limited to repositories that meet criteria such as:
The upstream archive service does not return deterministic byte streams.
The port currently needs
vcpkg_from_git()for this reason.The upstream repository is stable enough to support automated mirroring.
The repository license permits redistribution through a public mirror.
GoogleSource-hosted dependencies would likely be the main initial use case.