Support for package resolving from different origins

[cpfeiffer]

I would like to be able to allow getting the same package from different origins. But the "hosted" URL of a package dependency appears to be part of the "package identity". Here it is explained that this is not supported atm:

However, conflicts can easily arise if your dependencies require a package with the same name from different repositories. For example, if package retry requires meta from pub.dev, and example_package requires meta from https://dart-packages.example.com. Therefore, if mirroring any packages into a private package repository it’s often necessary to mirror all dependencies and either update the dependencies section of each package, or override the default package repository.

IMHO it would be desirable to separate origin from identity. Imagine publishing packages with interdependencies for two years to your private registry, and then, for some reason, the host name/domain name changes. All these packages would become unusable, AFAIU. Or if you want to make them available to a customer -- you currently cannot provide the same packages through a different host.

As a package consumer, I would like to specify, or at least be able to override, where dependencies are fetched from.

FWIW, this is also how some other dependency managers work, e.g. maven, ivy, gradle, etc.

[sigurdm]

The package identity seen from the point of dart is only the package name. The question is I guess when a package A depends on another hosted package B, should B by default be from pub.dev or by default from the same host as A is hosted on (in pub it is from pub.dev (or actually PUB_HOSTED_URL by default)).

We have previously discussed allowing "mirroring urls" (such that fetching packages from hostA instead of hostB.

Another solution would be to have a way of saying "from the same host"...

or at least be able to override,

We have dependency_overrides. That can override where each package is fetched from.

[cpfeiffer]

In e.g. Maven-land, it doesn't matter at all, from which repository an artifact is downloaded from, as long as the coordinates (GAV, groupId, artifactId, version) match. But still, you can run into a similar problem -- if a pom.xml declares a repository with a URL, and that URL is not accessible, the build will fail.

A discussion about this topic is here. The problems pointed out about a single settings.xml per user, where all repositories shall be managed, becomes moot as soon as you use one settings.xml per project instead, which is also what the newest Maven versions are suggesting (project/.mvn/settings.xml).

So to sum up, IMHO it would be desirable to

• let dart packages declare hosted repositories ✔️
• let consumers override declared hosted repositories
• optionally let consumers specify the repositories to use entirely, ignoring any declared hosted repositories

such that package compatibility does not depend on the repository hostname anymore.

dependecy_overrides only help a little, because one would have to redeclare all transitive dependencies, which is what one wants the package manager to do.

[sigurdm]

Related to: #2226

[sigurdm]

Related to #2993