So if a package in hex.pm does NOT have a GitHub link, where is the source? (Examples: cf & fs.)
This is for some auditing, so unfortunately just letting mix fetch it is not adequate, I have to provide a link to the online sources.
2 Likes
you should find e-mails at least for project maintainers on hex.pm
1 Like
well, yeah, but the source has to be accessible via hex, since mix deps can get it
and, to be clear, I need the URL that mix deps uses
1 Like
sure the sources are available, they are inside package.
Remove your “deps” directory. Then run “mix deps.get”. It will re-download all the packages. It will output something like this to console:
- Getting hackney (Hex package)
Checking package (https://hexpmrepo.global.ssl.fastly.net/tarballs/hackney-1.6.0.tar)
Using locally cached package- Getting ssl_verify_fun (Hex package)
Checking package (https://hexpmrepo.global.ssl.fastly.net/tarballs/ssl_verify_fun-1.1.0.tar)
Using locally cached package- Getting mimerl (Hex package)
Checking package (https://hexpmrepo.global.ssl.fastly.net/tarballs/mimerl-1.0.2.tar)
Using locally cached package- Getting metrics (Hex package)
Checking package (https://hexpmrepo.global.ssl.fastly.net/tarballs/metrics-1.0.1.tar)
Using locally cached package- Getting idna (Hex package)
Checking package (https://hexpmrepo.global.ssl.fastly.net/tarballs/idna-1.2.0.tar)
Basically I think the URL is https://hexpmrepo.global.ssl.fastly.net/tarballs/packagename-package.version.number.tar.
Untar it. Inside will be file contents.tar.gz. Untar it. You’ll find sources inside.
4 Likes
I figured it would be easy, just not that embarrassingly easy! Seriously, I never really noticed that on a fresh mix deps.get it was listing the URLs as it fetched them.
Anyway, that’s a perfect answer.
2 Likes
