hexpm / hex

Package manager for the Erlang ecosystem.

Hex

Hex is a package manager for the Erlang ecosystem.

This project currently provides tasks that integrate with Mix, Elixir's build tool.

See hex.pm for installation instructions and other documentation.

Contributing

Install Hex locally for development with: mix install.

Bundled CA certs

Hex bundles a list of root CA certificates used for certificate validation in HTTPS. The certificates are fetched from Mozilla's source tree with curl's mk-ca-bundle.pl script. The bundle created from the Perl script is stored in lib/hex/http/ca-bundle.crt and is included in source control, the file should be updated when new releases are made by Mozilla. When Hex is compiled the certificates are parsed and included with the compiled artifacts. The task mix certdata automates this process.

hexpm

Integration tests run against the API server hexpm. It needs to be cloned into ../hexpm or HEXPM_PATH needs to be set and point its location. hexpm also requires postgresql with username postgres and password postgres.

Exclude integration tests with mix test --exclude integration.

License

Copyright 2015 Six Colors AB

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at

   http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

hex's Issues

Can't register a user

When I try to register I get this error:

Registering...
Registration of user lowks failed (http_error)
{:failed_connect, [{:to_address, {'hex.pm', 443}}, {:inet, [:inet], :nxdomain}]}

Publish Elixir Semver requirement with each release

Currently the metadata.exs (soon to be an Erlang term file as of #41) does not contain the Elixir Semver version requirement (eg. "~> 0.15.0"). Once this is completed, it will most likely close both #26 and hexpm/hexpm#20. (This will also be used in hexpm/hexpm#25 to display version requirements on package pages)

If this is added, the Elixir version will be published with all future Hex packages in the tarball. However, for older Hex versions, we can simply traverse the Mix.exs file in the contents.tar.gz for the Elixir verion requirement.

Virtually, when resolving the package, we can run the following to check if the Elixir version matches the dependency:

requirement = "~> 0.15.1" # example
Elixir.System.version |> Version.match?(requirement)

If the version requirement does not match the current requirement, it will warn the user (toggle-able via command line flag) and possibly halt the installation (again, would be toggle-able via command line flag)

Older Hex versions would simply ignore the Elixir requirement in the metadata and continue to operate as usual.

If an admin could confirm this is the right direction for this issue, I'd be happy to put together a PR 👍

Move Hex.API into domain specific namespaces

Provide details on the number of downloads of a given package

For a tool like beam-toolbox, being able to get the number of times a given package has been downloaded via the API would be outstanding.

(ericmj mentioned opening an issue on this when I asked him in IRC)

Hex fails when we change the SCM for a dependency

ExDoc in Ecto today is a git dependency:

https://github.com/elixir-lang/ecto/blob/master/mix.exs#L31

If we remove the :github key because we want to fetch it from Hex, it will fail with the following message:

** (CaseClauseError) no case clause matching: {:ok, {:git, "git://github.com/elixir-lang/ex_doc.git", "7c1efb88bce770b42e4f88ce01d0ed9acc45a467", []}}
    lib/hex/remote_converger.ex:151: anonymous fn/2 in Hex.RemoteConverger.prepare_locked/3
    (elixir) lib/enum.ex:793: anonymous fn/3 in Enum.flat_map/2
    (elixir) lib/enum.ex:1261: Enum."-reduce/3-lists^foldl/2-0-"/3
    (elixir) lib/enum.ex:792: Enum.flat_map/2
    lib/hex/remote_converger.ex:149: Hex.RemoteConverger.prepare_locked/3
    lib/hex/remote_converger.ex:26: Hex.RemoteConverger.converge/2
    (mix) lib/mix/dep/converger.ex:79: Mix.Dep.Converger.all/4
    (mix) lib/mix/dep/converger.ex:47: Mix.Dep.Converger.converge/4

Hex should ignore/remove the lock in case it doesn't know it.

Tasks accepting a password should be able hide it

Tasks accepting a password through the command line, example: mix hex.key new -u johndoe -p hunter42. The user should be able to leave off the -p flag and the user will be prompted for a password that will be hidden on input.

Use SSL to CDN

Dependency check for Elixir version

Elixir version: 0.13.1

Had 0.4.2 version of Plug in the mix.exs.
Did mix deps.update --all
Updated Plug to 0.4.3
Then complained about elixir version not being 0.13.2

Expected:
If 0.4.3 version of Plug expects 0.13.2 version of Elixir and that is not what is present, it should not have updated the Plug version. It should have failed or skipped the dependency update with a warning.

Issue when publishing with wrong links type

Validation failed
** (ArgumentError) argument error
    :erlang.bit_size(%{"links" => "unknown type, expected: dict(string, string)"})
    lib/hex/util.ex:168: anonymous fn/2 in Hex.Util.pretty_errors/2
    (elixir) lib/enum.ex:540: anonymous fn/3 in Enum.each/2
    (elixir) lib/enum.ex:1246: anonymous fn/3 in Enum.reduce/3
    (elixir) lib/enum.ex:2171: Enumerable.Map.do_reduce/3
    (elixir) lib/enum.ex:1245: Enum.reduce/3
    (elixir) lib/enum.ex:539: Enum.each/2
    lib/mix/tasks/hex/publish.ex:151: Mix.Tasks.Hex.Publish.create_package?/2

package in mix.exs should be allowed to be a keywords list

Add tarball checksums to the registry

• Ensure that all checksums are correct in the DB
• Add to registry (does not require bump)
• Check if tarball checksum is correct before unpacking

Do not always call ensure_registry on the remote converger

https://github.com/hexpm/hex/blob/master/lib/hex/remote_converger.ex#L15

We should check if there is any update to be done and only call if then. Basically, mix deps.get should be close to a no-op if everything is OK.

Parallelise package downloads

We could start downloading tarballs after dependency resolution and wait for the downloads to complete in SCM.checkout / SCM.update.

Move from ~/.mix to ~/.hex

Support forks through :hex option on dependency definition

401 error publishing after creating an API key on new machine

I recently switched machines and had to generate a new API key for my hex user. However, now I'm receiving a Updating package calliope failed (401).

Any thoughts?

Rename ENV var `HEX_URL` => `HEX_API`

Uploading large packages are not handled well.

I have an Elixir project which bundles a Jar package. The Jar package is a "uber jar" it contains all of its dependencies. This makes it (unfortunately) about 6.8MB in size.

When using Hex to upload the package I get error output like:

Proceed? [Yn] y
[#########################] 100%
10:57:19.116 [error] [85, 110, 107, 110, 111, 119, 110, 32, 109, 101, 115, 115, 97, 103, 101, 32, 105, 110, 32, 104, 116, 116, 112, 99, 95, 109, 97, 110, 97, 103, 101, 114, 58, 104, 97, 110, 100, 108, 101, 95, 105, 110, 102, 111, 32, [123, ['#Ref<0.0.0.399>', 44, ...], 125], '\n']
[#######################  ] 93%
Published diver v0.1.1

I believe the release is uploaded to Hex successfully but the error message makes me unsure.

protocol Access not implemented for "{\"error\":500}"

Don't know whether my elixir version is not the correct one or what the matter is..

» mix hex.publish
Publishing facebook v0.1.0
  Dependencies:
  Excluded dependencies (not part of the Hex package):
    json
    hackney_lib
    hackney
    exlager
    libex_config
  Included files:
    lib/facebook
    lib/facebook.ex
    lib/facebook/config.ex
    lib/facebook/graph.ex
    mix.exs
    README.md
    LICENSE
Proceed? [Yn] y
** (UndefinedFunctionError) undefined function: List.from_char_data!/1
    (elixir) List.from_char_data!("SOMETOKEN")
    lib/hex/api.ex:130: Hex.API.auth/1
    lib/hex/api.ex:26: Hex.API.new_package/3
    lib/mix/tasks/hex/publish.ex:133: Mix.Tasks.Hex.Publish.create_package?/2
    lib/mix/tasks/hex/publish.ex:97: Mix.Tasks.Hex.Publish.run/1
    (mix) lib/mix/cli.ex:63: Mix.CLI.run_task/2
    (elixir) src/elixir_lexical.erl:17: :elixir_lexical.run/2

» mix hex.info
Hex v0.1.0-dev

** (UndefinedFunctionError) undefined function: List.from_char_data!/1
    (elixir) List.from_char_data!("/Users/michael/.mix/hex.ets")
    lib/hex/registry.ex:9: Hex.Registry.start/1
    lib/mix/tasks/hex/info.ex:40: Mix.Tasks.Hex.Info.general/0
    (mix) lib/mix/cli.ex:63: Mix.CLI.run_task/2
    (elixir) src/elixir_lexical.erl:17: :elixir_lexical.run/2
    (elixir) lib/code.ex:303: Code.require_file/2

» iex 
Erlang/OTP 17 [erts-6.0] [source] [64-bit] [smp:4:4] [async-threads:10] [hipe] [kernel-poll:false] [dtrace]

Interactive Elixir (0.13.0) - press Ctrl+C to exit (type h() ENTER for help)

Do you need more infos?

Tell user that umbrella projects are not yet supported

Make prereleases in requirements explicit

@meh's idea from Rubygems.

Only allow prereleases if pre: true is in the dependency options. Example: { :ecto, "~> 0.1.0", pre: true }.

I think ~> 0.1.0-dev should match ~> 0.1.1 or (>= 0.1.0-dev and < 0.1.1). This behaviour is useful when you depend on some feature in, not yet released, 0.1.0, but you still dont want to match prereleases for versions after 0.1.0.

/cc @josevalim

Erlang tooling

Investigate how tooling for Erlang users should work.

Show if package is optional when publishing

Installation issue with Hex on OS X Yosemite

I am getting the following error when i run 'mix local.hex' to install hex

ERROR: The certificate of ‘hex.pm’ is not trusted.
ERROR: The certificate of ‘hex.pm’ hasn't got a known issuer.
** (Mix) Could not fetch data, please download manually from "https://hex.pm/installs/hex.ez" and copy it to "/var/folders/z_/zpffmzmj4f14_glbm863nfmm0000gn/T/hex.ez"

Mix version is 1.0.0

Crashes when the dep format in mix.exs is malformed

First I was running Elixir v0.13.1, then upgraded to master.

This happened in the context of an umbrella project with one app. I set a local dependency for that app like this:

[{:wyvern, Path.expand("../../wyvern", __DIR__)}]

And this is what I got:

λ mix deps.get
Running dependency resolution
Unlocked:   wyvern
** (Protocol.UndefinedError) protocol Enumerable not implemented for nil
    (elixir) lib/enum.ex:1: Enumerable.impl_for!/1
    (elixir) lib/enum.ex:112: Enumerable.reduce/3
    (elixir) lib/enum.ex:653: Enum.filter/2
    lib/hex/resolver.ex:90: Hex.Resolver.get_versions/2
    lib/hex/resolver.ex:51: Hex.Resolver.do_resolve/3
    lib/hex/remote_converger.ex:40: Hex.RemoteConverger.converge/2
    (mix) lib/mix/dep/converger.ex:71: Mix.Dep.Converger.all/4
    (mix) lib/mix/dep.ex:111: Mix.Dep.unloaded/4


# This is probably after update to Elixir master, hence the different trace at
# the bottom:

λ mix deps.get
Running dependency resolution
Unlocked:   wyvern
** (Protocol.UndefinedError) protocol Enumerable not implemented for nil
    (elixir) lib/enum.ex:1: Enumerable.impl_for!/1
    (elixir) lib/enum.ex:112: Enumerable.reduce/3
    (elixir) lib/enum.ex:653: Enum.filter/2
    lib/hex/resolver.ex:90: Hex.Resolver.get_versions/2
    lib/hex/resolver.ex:51: Hex.Resolver.do_resolve/3
    lib/hex/remote_converger.ex:40: Hex.RemoteConverger.converge/2
    (mix) lib/mix/dep/converger.ex:78: Mix.Dep.Converger.all/4
    (mix) lib/mix/dep/converger.ex:47: Mix.Dep.Converger.converge/4

λ mix hex.version
** (CaseClauseError) no case clause matching: {:ok, {:git, "git://github.com/alco/wyvern.git", "7020ab5ae39fde2422ae028286e4b2d955f32b47", []}}
    lib/hex/remote_converger.ex:50: Hex.RemoteConverger.deps/2
    (mix) lib/mix/dep/converger.ex:96: anonymous fn/4 in Mix.Dep.Converger.all/4
    (mix) lib/mix/dep/converger.ex:149: Mix.Dep.Converger.all/8
    (mix) lib/mix/dep/converger.ex:47: Mix.Dep.Converger.converge/4
    (mix) lib/mix/dep.ex:61: Mix.Dep.loaded/1
    (mix) lib/mix/tasks/deps.check.ex:23: Mix.Tasks.Deps.Check.run/1
    (mix) lib/mix/tasks/deps.loadpaths.ex:15: Mix.Tasks.Deps.Loadpaths.run/1
    (mix) lib/mix/tasks/compile.ex:61: Mix.Tasks.Compile.run/1

λ mix hex.info
Hex v0.1.1

Registry file available (last updated: 2014-05-04 00:55:36)
Size: 3kB
Packages #: 30
Releases #: 55

Fixing the dep tuple format like this

[{:wyvern, git: Path.expand("../../wyvern", __DIR__)}]

fixed the issue.

Improve http timeouts for fetching and publishing packages

Add ability to use multiple API endpoints.

Currently, Hex only works with one API/CDN endpoint. This is fine for public users, but for organizations running Hex on their own infrastructure, this can be a pain to have to manually edit.

My proposal is to add a ~/.hex/endpoints.config file in the format:

[default: {"cdn_url", "api_url"}, work: {"cdn_url", "api_url"}]

This could be toggled using mix hex.endpoint use work or mix hex.endpoint switch for a prompt input.

Adding this would allow users to quickly switch between registries and CDNs, allowing them to install packages hosted on privately run Hex instances.

This could also be used for mirrors of the S3 bucket (eg. EU or AU).

Thoughts? 👍 or 👎?

Task `hex.publish` seems to ignore provided `files` list

Affected version: 0.2.1

Reproducable: Yes, just create bare project, add some custom files and folders, add these to the files list. Then try to publish this package.

---

My test setup:

defmodule HexTest.Mixfile do
  use Mix.Project

  def project do
    [
      app: :hex_test,
      version: "0.0.1",
      elixir: "~> 0.13.2",
      deps: [],
      description: "HexTest for additional files",
      package: [
        contributors: ["Christoph Grabo"],
        license: "MIT",
        links: [{"No", "link"}],
        files: ~w[ mix.exs README.md lib foo cruft config ]
      ]
    ]
  end

  def application do
    [applications: [],
     mod: {HexTest, []}]
  end
end

Directory tree:

.
├── config
│   └── config.exs
├── cruft
│   └── file
├── foo
│   └── bar
├── lib
│   ├── hex_test
│   │   └── supervisor.ex
│   └── hex_test.ex
├── mix.exs
├── README.md
└── test
    ├── hex_test_test.exs
    └── test_helper.exs

6 directories, 9 files

Hex publish step:

Publishing hex_test v0.0.1
  Dependencies:
  Excluded dependencies (not part of the Hex package):
  Included files:
    lib/hex_test.ex
    lib/hex_test/supervisor.ex
    mix.exs
    README.md
Proceed? [Yn]

Any ideas? Or is it a bug?

Use elixir version requirement during resolution

This change should happen in conjunction with the 1.0.0 release of Elixir.

Cannot install new version of hex after fresh install of Elixir 1.0.2 (Windows)

After installing Elixir 1.0.2 with the Windows installer, running mix commands results in the following print:

Mix requires hex >= 0.5.0 but you have 0.4.2
Shall I abort the current command and update hex? [Yn]

Answering Y results in the following error:

** (Mix.Error) Unable to overwrite open archives on Windows. Run the command aga
in
    (mix) lib/mix.ex:235: Mix.raise/1
    (mix) lib/mix/tasks/archive.install.ex:58: Mix.Tasks.Archive.Install.install
_archive/2
    (mix) lib/mix/tasks/local.hex.ex:55: Mix.Tasks.Local.Hex.ensure_updated?/0
    (mix) lib/mix/cli.ex:22: Mix.CLI.proceed/1
    (elixir) lib/code.ex:316: Code.require_file/2

The same error occurs when attempting to install hex with mix local.hex

Normalize metadata and request params

1. make all requests and the metadata be a map with binaries keys
2. replace Macro.safe_terms for something that only allows binaries, integers, lists, tuples and maps. The new implementation must not allow atoms at all, even if the atom was allowed by Code.string_quoted existing atoms only

Change tarball metadata file to an erlang term file

• Support it on the server
• Bump tarball version support on the client (2014-08-12) (Hex v0.4.1) (Elixir v0.15.0)
• Build the new tarballs on the client when publishing (2015-02-11) (Hex v0.7.0)
• Change existing tarballs

Crash in hex.user.update

λ mix hex.user.update
** (Mix.Error) Missing command line option: user
    lib/mix/tasks/hex/util.ex:41: anonymous fn/2 in Mix.Tasks.Hex.Util.required_opts/2
    (elixir) lib/enum.ex:967: Enum."-map/2-lc$^0/1-0-"/2
    lib/mix/tasks/hex/user.update.ex:24: Mix.Tasks.Hex.User.Update.run/1
    (mix) lib/mix/cli.ex:66: Mix.CLI.run_task/2
    (elixir) src/elixir_lexical.erl:17: :elixir_lexical.run/2
    (elixir) lib/code.ex:299: Code.require_file/2

λ mix hex.info
Hex v0.2.5

Registry file available (last updated: 2014-06-18 05:57:37)
Size: 16kB
Packages #: 66
Versions #: 192

Support optional dependencies

There will be upcoming changes to Mix and we need to support optional dependencies in them. In order for this to work, optional dependencies needs to be on the index (they are never fetched but listed as deps by converger.deps(dep)).

Registry not generated on installation

After installing hex with mix local.hex --force on my build server I noticed that other basic mix commands began to fail due to an ENOENT error when attempting to read the Hex registry (~/.mix/hex.ets).

I alleviated this postfixing a build step to my build jobs that checks for the existence of the hex registry and generates it if it doesn't exist by running mix hex.search {any_package}.

It appears that either the registry should be generated on installation or that it shouldn't be loaded if a task is being run which doesn't require it.

Add proxy support

Add support for http_proxy and https_proxy env vars, enabling hex and mix to work from behind firewall.

Could not start Hex.

Steps to recreate:

• $ mix new my_project --bare
• Include :phoenix into mix.exs
  ie:

  def application do
    [applications: [:logger, :phoenix]]
  end

and

  defp deps do
    [
      {:phoenix, "0.4.1"},
    ]
  end

• $ mix deps.get

What should happen:

• Download the phoenix dependency

What does happen:

Could not start Hex. Try fetching a new version with `mix local.hex` or uninstalling it with `mix archive.uninstall hex.ez`
** (FunctionClauseError) no function clause matching in String.to_char_list/1
    (elixir) lib/string.ex:1344: String.to_char_list(nil)
    lib/hex.ex:70: Hex.proxy/1
    lib/hex.ex:27: Hex.start_api/0
    lib/hex.ex:9: Hex.start/0
    (mix) lib/mix/tasks/local.hex.ex:68: Mix.Tasks.Local.Hex.start/0
    (mix) lib/mix/dep/loader.ex:117: Mix.Dep.Loader.with_scm_and_app/1
    (mix) lib/mix/dep/loader.ex:86: Mix.Dep.Loader.to_dep/3
    (elixir) lib/enum.ex:977: Enum."-map/2-lc$^0/1-0-"/2

Further

• Running $ mix by itself results in the same issue as above
• Everything runs perfectly well until I add a dependency

Versions:

• OS: Nixos
• Elixir version: 1.0.0
• Erlang version: Erlang 17

Package signing

As discussed on IRC (initially by laut). This is currently just a place for discussion, thoughts and ultimately a solution to the issue of signed packages.

override: true leads to CaseClauseError

I was trying to get Ecto to work on 13.2-dev. Ran mix deps.update --all, compiled and got:

Unchecked dependencies for environment dev:
* decimal (git://github.com/ericmj/decimal.git)
  different specs were given for the decimal app:

  > In /Users/patrick/projects/einsatz/deps/ecto/mix.exs:
    {:decimal, "~> 0.1.0", [git: "git://github.com/ericmj/decimal.git"]}

  > In /Users/patrick/projects/einsatz/deps/postgrex/mix.exs:
    {:decimal, "~> 0.1.2", [hex_app: :decimal]}

  Ensure they match or specify one of the above in your DataManager.Mixfile deps and set `override: true`
** (Mix) Can't continue due to errors on dependencies

So I added override: true to my mix.exs. Compiled again and got:

** (CaseClauseError) no case clause matching: {:ok, {:git, "git://github.com/ericmj/decimal.git", "f58c7dce8ef3b20968d0c5e5e8f6795b0d572d89", []}}
    lib/hex/remote_converger.ex:50: Hex.RemoteConverger.deps/2
    (mix) lib/mix/dep/converger.ex:96: anonymous fn/4 in Mix.Dep.Converger.all/4
    (mix) lib/mix/dep/converger.ex:149: Mix.Dep.Converger.all/8
    (mix) lib/mix/dep/converger.ex:47: Mix.Dep.Converger.converge/4
    (mix) lib/mix/dep.ex:61: Mix.Dep.loaded/1
    (mix) lib/mix/tasks/deps.check.ex:23: Mix.Tasks.Deps.Check.run/1
    (mix) lib/mix/tasks/deps.loadpaths.ex:15: Mix.Tasks.Deps.Loadpaths.run/1
    (mix) lib/mix/tasks/app.start.ex:22: Mix.Tasks.App.Start.run/1

The Hex.RemoteConverger.deps can only handle the {:ok, {:package, version}} case and no git deps.

Reword "fetching package" when using conditional GET

mix hex.info fails after upgrading to elixir 0.14.0

There was an initial issue even running: mix deps.get when pulling from hex.pm. So I decided to just look at hex...

$mix hex.info
Hex v0.2.4

Registry update failed (http_error)
:timeout
** (MatchError) no match of right hand side value: :undefined
    lib/hex/registry.ex:114: Hex.Registry.get_tid/0
    lib/hex/registry.ex:64: Hex.Registry.stat/0
    lib/mix/tasks/hex/info.ex:41: Mix.Tasks.Hex.Info.general/0
    (mix) lib/mix/cli.ex:66: Mix.CLI.run_task/2
    (elixir) src/elixir_lexical.erl:17: :elixir_lexical.run/2
    (elixir) lib/code.ex:296: Code.require_file/2

And I fixed it by running:

mix local.hex
Found existing archives: hex.ez.
Are you sure you want to replace them? [Yn] 
* creating /home/alex/.mix/archives/hex.ez

And it works now:

mix hex.info
Hex v0.2.4

Registry file available (last updated: 2014-06-13 13:37:51)
Size: 15kB
Packages #: 66
Versions #: 182

Do you know what could of caused the problem?

Add multiple package owners

Tasks:

hex.owner add ecto [email protected]
hex.owner drop ecto [email protected]
hex.owner list ecto

Don't echo password when registering a user

I think it's common to not echo the password in a shell in case you need to enter the password. I've seen that you use IO.gets for this so probably elixir would need to have a password-prompt command ( read -s works in bash e.g., don't know how to implement this though)..

Timeout on fetching

This kind of error is unexpected? Or should at least have a better message?

Fetching package (http://s3.hex.pm/tarballs/exrm-0.12.12.tar)
** (exit) exited in: :gen_server.call(:hex_fetcher, {:await, {:exrm, "0.12.12"}}, 5000)
    ** (EXIT) time out
    (stdlib) gen_server.erl:190: :gen_server.call/3
    lib/hex/scm.ex:65: Hex.SCM.checkout/1
    (mix) lib/mix/dep/fetcher.ex:61: Mix.Dep.Fetcher.do_fetch/3
    (mix) lib/mix/dep/converger.ex:154: Mix.Dep.Converger.all/8
    (mix) lib/mix/dep/converger.ex:164: Mix.Dep.Converger.all/8
    (mix) lib/mix/dep/converger.ex:47: Mix.Dep.Converger.converge/4
    (mix) lib/mix/dep/fetcher.ex:16: Mix.Dep.Fetcher.all/3
    (mix) lib/mix/tasks/deps.get.ex:22: Mix.Tasks.Deps.Get.run/1

I wonder if the file download is taking too long and the GenServer is timing out...

Root task (mix hex) should display help

mix hex should display help for all tasks provided, show some examples of how to use these commands, and link to any further documentation. This would be helpful for newcomers.

Touch all files after unpack to ensure recompilation

Related: elixir-ecto/ecto#244.

Change config file to erlang term file

Warn for missing meta fields before publishing

Fetch cached packages less often

Fetch every time the first hour. After that fetch once every 24h(?).

Keep using conditional GETs.

Requires adding creation time of releases to the registry.

mix deps.update

seems mix deps.update doesn't work

$ mix hex.info faker
faker
  Releases: 0.2.0, 0.1.0

  Contributors: Igor Kapkov
  Licenses: MIT
  Links:
    Github: https://github.com/igas/faker

Faker is pure Elixir library for generating fake data.

$ mix deps.update faker
Running dependency resolution for unlocked dependencies: phoenix, faker
Dependency resolution completed successfully
  faker: v0.1.0
  phoenix: v0.1.0