I just created a dub package. Frankly, the whole thign is backward.

[Ola Fosheim Grøstad]

On Wednesday, 27 April 2022 at 06:48:48 UTC, Ola Fosheim Grøstad 
wrote:
>> When you invoke conan, or in your config file, you can tell it 
>> to only build from source so it will not download the binary 
>> package even if available.
>
> Thanks, I might have look at Conan then… :)
>
> (I guess it is ok if the binaries are reproducible and built on 
> a secure cloud solution and not by individual contributors, but 
> it still sounds like a risk to my ears.)


Seems like vcpkg has expanded their scope, by automatically 
downloading compilers, linkers and SDKs for embedded development:

https://devblogs.microsoft.com/cppblog/vcpkg-artifacts/

>  «The experience is in preview and currently focused on 
> embedded developers. We will expand the scope in the future to 
> include any developers targeting Linux, macOS, or Windows.»

Not sure how they plan to ensure the quality/security of this 
approach, but I guess Microsoft can afford to pay staff to do the 
auditing (if they do it).

It would be a grave mistake to try to replicate any of this for a 
small player like the D community. It would be better to get LDC 
and other dependencies into vcpkg.