[vcpkg] update msys2-runtime version to 3.4.6-1

[Adela0814]

Fixes #30542
msys2-runtime-3.2.0-8-x86_64.pkg.tar.zst is no longer available on https://repo.msys2.org/msys/x86_64/, updated to the latest version msys2-runtime-3.4.6-1.

Error message:

Downloading https://mirrors.sjtug.sjtu.edu.cn/msys2/msys/x86_64/msys2-runtime-3.2.0-8-x86_64.pkg.tar.zst
error: Failed to download from mirror set
error: https://repo.msys2.org/msys/x86_64/msys2-runtime-3.2.0-8-x86_64.pkg.tar.zst: failed: status code 404

• Changes comply with the maintainer guide
• SHA512s are updated for each updated download
• The "supports" clause reflects platforms that may be fixed by this new version
• Any fixed CI baseline entries are removed from that file.
• Any patches that are no longer applied are deleted from the port's directory.
• The version database is fixed by rerunning ./vcpkg x-add-version --all and committing the result.
• Only one version is added to each modified port's versions file.

[mattahorton]

Replying to follow. This one is holding up our release.

[dg0yt]

Replying to follow. This one is holding up our release.

Note that there is a "Subscribe" button. It wouldn't generate e-mail notifications to subscribers.

[vserdyuk]

Why is this repo.msys2.org mirror still used? It always breaks so we have to pull recent changes from vcpkg to our private fork. We've pulled changes a couple of weeks ago, and now this is broken again. Maybe use some mirror that does not have old versions deleted? E.g. https://mirrors.piconets.webwerks.in/msys2-mirror (listed in https://www.msys2.org/dev/mirrors).

Edit: Or, maybe, M$ would provide it's own mirror?

[dg0yt]

Old packages are removed from the msys2 repos 1.5 years after an update. This is plenty of time to update vcpkg, or to make your local copy to feed in via asset caching or downloads.
Nevertheless I would like to catch this more automatically: #29067

[equeim]

Disappearing download links are bad for reproducible builds. Updating vcpkg might require changes in your app which means that you basically lose the ability to build your released versions exactly as they were at the time of release.

[vserdyuk]

Old packages are removed from the msys2 repos 1.5 years after an update. This is plenty of time to update vcpkg, or to make your local copy to feed in via asset caching or downloads.

I think this applies to vcpkg maintainers rather than vcpkg users.

Thank you for investing your time into #29067. If this helps vcpkg maintainers to proactively update ports before links are expired, this would eventually improve vcpkg users' experience.

[dg0yt]

I'm glad to see that this passes CI on first run. 🎉

[Kingtous]

How long will this PR be merged?

Currently, we are blocked here. rustdesk/rustdesk#3858.

[mattahorton]

Would merging this immediately solve downstream issues? Or would we need to wait for a new release?

[dbenson2000]

Disappearing download links are bad for reproducible builds. Updating vcpkg might require changes in your app which means that you basically lose the ability to build your released versions exactly as they were at the time of release.

vcpkg needs to make this a priority, we all can't live at head. Stable, reproducible builds are critical. We had to update vcpkg to the February release for this same issue. As other have commented, I can see a few approaches to making this more stable:

• Microsoft mirrors versions
• Asset caching needs to support the same options as binary caching. (https://learn.microsoft.com/en-us/vcpkg/users/assetcaching)

vcpkg has been great for us for three years, but a few more issues like this and I'll invest the time in looking at other package managers.

edit: The issue we hit in February was for libtool, not msys2-runtime but the root cause is the same, artifacts being expired off the mirror servers as new versions are released.

Maintaining the downloads folder works for yourself but doesn't work for new joiners or new CI machines.

[Neumann-A]

Document how to maintain a local mirror

https://learn.microsoft.com/en-us/vcpkg/users/assetcaching

also storing the DOWNLOADS folder was always a way to make sure stuff stays available.

[justusranvier]

Is a real catastrophe to lose the ability to build old versions of an app because someone decided to expire download links.

There needs to be some better systematic way to keep old artifacts around if upstream maintainers are going to behave like this.

[Brambor]

Just doing git-bisect and this slaps me into my face.

1.5 years is a very short time. If it were 10 years I would be (more) OK with it.

Why aren't they storing it anyway? The storage requirements are SO LOW, and if nobody requests it all you are doing is storing it essentially for free 😡.

[connorjclark]

Is the problem of reproducibility / expiring assets something that vcpkg maintainers are looking into? Is there an issue to follow on the subject?

Was just hit by this for mingw/i686/mingw-w64-i686-libwinpthread-git-9.0.0.6373.5be8fcd83-1-any.pkg.tar.zst

[Adela0814]

Is the problem of reproducibility / expiring assets something that vcpkg maintainers are looking into? Is there an issue to follow on the subject?

Was just hit by this for mingw/i686/mingw-w64-i686-libwinpthread-git-9.0.0.6373.5be8fcd83-1-any.pkg.tar.zst

Please update your vcpkg and use the clean source, the acquire version of libwinpthread in vcpkg is: "https://mirror.msys2.org/mingw/mingw64/mingw-w64-x86_64-libwinpthread-git-10.0.0.r234.g283e5b23a-1-any.pkg.tar.zst".

[dg0yt]

Is the problem of reproducibility / expiring assets something that vcpkg maintainers are looking into? Is there an issue to follow on the subject?

AFAIK there is no specific issue.

• You should always be able to use the latest (unversioned) vcpkg build scripts. (That's what the previous comment suggests.)
• I contributed a test port which helps to monitor the msys2 packages for age, so updates could happen early. (If they pass CI. This is ad different story.) The earlier the update, the more you get from msys2's package availability. (ATM they keep package for 1.75 years after an update was made available.)
• The msys2 package go through normal asset caching. You should configure caching in your CI to get control of expiring external assets. And there is also your local cache in downloads.