Can we skip SHA512 validation from vcpkg_from_github?

[diehard2]

I see this has been requested before and people were open to it.

#7100

Also, vcpkg_from_git doesn't have this at all, and it looks like it was removed based on the above discussion https://learn.microsoft.com/en-us/vcpkg/maintainers/functions/vcpkg_from_git

The reason I would like to skip it is because I'm maintaining a decent sized repository for my organization, and if I wasn't doing this SHA512 step, the automation of version updates would be relatively trivial. as it is, its really painful when i'm updating a bunch of these and I would be very willing to give up the extra sanity check so I could skip this. For one port its not bad, for 40 it takes me forever

[autoantwort]

As a workaround you could maybe use microsoft/vcpkg-tool#166 and #19679

[diehard2]

it looks like that (really excellent idea) was closed without being fully implemented?

[autoantwort]

It is fully implemented, but they don't like how it was done. They only wanted a implementation that worked in less cases and I don't wanted that.

[Osyotr]

Another workaround is to copypaste vcpkg_from_github into new tool port mycorp_vcpkg_from_github, remove SHA512 check and modify your ports to use this function instead of vcpkg_from_github.

[dg0yt]

Skipping SHA512 has non-trivial consequences: It disables asset caching. And with changing assets for the same input files, there can't be reliable ABI hashing and artifact caching.

There is --head option to vcpkg install which builds the HEAD refs for each gitish port, i.e. ignores SHA512. This also takes care of disabling caching IIRC.

If --head isn't for you, you might use the option's private implementation detail to change behavior per port from a custom triplet file, by setting VCPKG_USE_HEAD_VERSION. But for the reaons given, you should completely disable artifact caching in that case.

[diehard2]

@dg0yt thanks, that makes a lot of sense. Maybe a small utility that one could run to make all of this easier? something like

python3 generate_hash_from_port myport

I can do this on my side, but then it would only benefit me. The issue is that if my port has a lot of dependencies, it will take a very long time to just get the failure with the updated value. Appreciate any help on this

[Osyotr]

You can probably save some time if you run vcpkg with --only-downloads to populate asset cache.