ability to specify additional build dependency mirrors that affect any package in the full dependency tree

[andrewrk]

Extracted from #14265.

After supporting URL mirrors (#14291), an additional enhancement is to allow any project in the dependency tree to provide additional mirrors for any dependency in the entire tree.

This might look something like:

.{
    .name = "libffmpeg",
    .version = "5.1.2",
    // ...
    .mirrors = .{
        .@"sha256=c9b30cffc40999d2c078ff350cbcee642970a224fe123c756d0892f876cf1aae" = .{
            "https://example.com/1.tar.gz",
            "https://example.com/2.tar.gz",
        },
    },
}

This would provide a way for a project to vendor dependencies in a git branch, or use something like git-subtrac.

[ikskuh]

Imho, this is a pretty important feature, especially in a company context. Consider the following scenario:

ACME is depending on some external packages (clap and zig-ini) and set up a local caching server where all their dependencies must be stored for archiving reasons.

This would require both an additional mirror (https://cache.acme.example.com/github.com/ziglibs/ini), but also the ability to remove the original mirrors, so they have the guarantee that zig will always fetch from their internal mirror.

Another option would be to give URLs a priority, so that Zig will prefer mirrors with higher priority first, and in this case, prefer the cache url over the others.

[daurnimator]

As a user compiling software, I shouldn't have to modify the build.zon to add my local mirror. I should be able to provide some sort of overrides file (or potentially via argument/environment variable?)

[ikskuh]

Good point! I guess it's better to not modify the project in order to add overrides

[nektro]

thats a separate but valid use case. the developer should still be able to provide mirrors as well