Unexpected hash from vcpkg_from_gitlab() for old library version

[mntt-SSE]

Hi!

I'm working on a company where we're trying to move a bunch of dependencies over to vcpkg. However, I've made a minimal example to demonstrate my question. The example has the following vcpkg.json file:

{
  "$schema": "https://raw.githubusercontent.com/microsoft/vcpkg-tool/main/docs/vcpkg.schema.json",
  "builtin-baseline": "5422eb983d4ca8bc4851ac9771d6e74554efc5c8",
  "name": "myxmlapp",
  "version-string": "1.0.0",
  "dependencies": [
    "libxml2"
  ],
  "overrides": [
    {
      "name": "libxml2",
      "port-version": 5,
      "version": "2.9.12"
    }
  ]
}

However, the download of libxml2 fails with this error message:

Building libxml2:x64-windows@2.9.12#5...
Downloading https://gitlab.gnome.org//GNOME/libxml2/-/archive/b48e77cf4f6fa0792c5f4b639707a2b0675e461b/libxml2-b48e77cf4f6fa0792c5f4b639707a2b0675e461b.tar.gz -> GNOME-libxml2-b48e77cf4f6fa0792c5f4b639707a2b0675e461b.tar.gz
GNOME-libxml2-b48e77cf4f6fa0792c5f4b639707a2b0675e461b.tar.gz.49620.part: error: download from https://gitlab.gnome.org//GNOME/libxml2/-/archive/b48e77cf4f6fa0792c5f4b639707a2b0675e461b/libxml2-b48e77cf4f6fa0792c5f4b639707a2b0675e461b.tar.gz had an unexpected hash
note: Expected: 2d20867961b8d8a0cb0411192146882b976c1276d2e8ecd9a7ee3f1eb287f64e59282736f58c641b66abf63ba45c9421f27e13ec09a0b10814cd56987b18cb5b
note: Actual  : 658cbf639ccbeb475c326fbe43b79b0a3f2c51cb4dad49c5b57601f33c1eb7ae02b8607de0aa9fc093e7e7dd0959c284b578d7d56cfd5e7b2d58bc90e6b7188a

How are you supposed to handle cases like this? You can't change the hash of an old version, since old versions just point to a commit hash of the vcpkg repo. And I don't want to upgrade the version since the actual project is a very big, and upgrading third party dependencies requires a lot of QA etc. It also seems a bit dangerous if the hash of the downloaded repo can just change at any time, making our build process stop working. Is there a way to tell vcpkg to ignore this hash maybe?

[Osyotr]

Option a) find an old archive somewhere and put it in your downloads.
Option b) create an overlay port and change the hash.
Option c) same as (b) but store it in your private registry on a separate branch.

It is recommended to setup asset caching to prevent issues like this.

[prvg-sso]

Interesting, so if I've understood this correctly: if you want to use a specific version of a vcpkg package, it will eventually fail to build as the github archive hash will eventually change after the port was written. Using an asset cache seems like a prerequisite to using vcpkg then. Also if you later turn on a feature for that port that pulls in an additional dependency, that can also fail to build.. Would it not make more sense to rely on the githash, instead of the archive hash, or at least have the gitref as a fallback? That would solve this issue alltogether.

[Osyotr]

github archive hash will eventually change after the port was written

Last time this happened was so bad that I doubt GitHub will make such change ever again.
https://github.com/orgs/community/discussions/45830#discussioncomment-4823799
Other hosts might reupload release tarballs, update git hashes or even disappear completely, you can't change that.

Using an asset cache seems like a prerequisite to using vcpkg then

Quote from #48783 (reply in thread):

I believe that every user has a responsibility to implement proper asset caching, for fair use of upstream resources and for long-term stability.