tree ce958bfa1bd74621f4c81ec7e9d086e4cd111dbe
parent 11e73c0c4d616ca21e681e0f1f1135d3e4a4ab00
author Jonas Finnemann Jensen <jonasfj@google.com> 1584624929 +0100
committer GitHub <noreply@github.com> 1584624929 +0100
gpgsig -----BEGIN PGP SIGNATURE-----
 
 wsBcBAABCAAQBQJec3UhCRBK7hj4Ov3rIwAAdHIIAC2yb+jTtZ2huzVF+qL35YP0
 7wf3SE1pVPTPl476LaOR00kwL0ei84x98gx1PKT1ZZycu+TClZqs7wVJ3u2YO+0d
 oLnW+GEb39ucaRAk3QoCR+e9gmScneSEBAq12FbQNi1MN3kAA7fbu2qYz/p8L0Vd
 Vypos+/2zPvj9UZEkfXjhZ/IS0jlOzKkdFiYWEzzbUZ3enO/QPtglvXiGokZiAhg
 6KOKXcxkn1FzZQGvwIAzhDDOeAkU8R2MA2Q7/uqiVBDxX6Zhl1oNemBfqZ7Fwtu1
 wUXGn6S4+6ZImzNodge9G1vSAeb+VJNtqwg3yd5VdHfChkrEjmLO9vwFZvp9PPE=
 =MFfh
 -----END PGP SIGNATURE-----
 

Deprecating the end-point for fetching package archives. (#2374)

In practice we don't need it as the list-versions API end-point already
returns an `archive_url`. If we switch clients to use this `archive_url`
we can easily change the URL that packages are downloaded from. Most
cases where a package has to be downloaded the client has to resolve
versions first, hence, we already have to call the list versions API. In
the rare cases where know what version we want, but we haven't done a
resolution this will cost us an extra round-trip, however, this seems
acceptable.

We are deprecating the end-point because we discovered that it was
conflicting with other end-points on `pub.dev`. Specifically,
`pub.dev/packages/<verion>` conflicts with
`pub.dev/packages/<version>.tar.gz` because a semver version number can
have a pre-release ending in `.tar.gz´. Example: `1.0.0-dev.tar.gz` is a
legitimate semver version number.

Note. servers will still have to support the deprecated API end-point
indefinitely, otherwise old clients will stop working. But since the
conflict only affects packages with obscure version numbers this seems
acceptable. It just means that some old clients might have problems
downloading package with version numbers that ends in `.tar.gz`.