@swift-ci create

Not sure we want to support this as you can already use the path-based version of binary targets and add them to the actual package's repo. What would be the incentive to have two repos?

Comment by Daniel Lazarenko (JIRA)

@neonichu

Our use case is having large multi-platform binaries (e.g. OpenSSL, WebRTC etc.), especially debug builds with debug symbols. We have multiple versions of those builds: v1, v2, v3... v100 - that quickly accumulates to gigabytes. If we put them into a git repo, SPM has to download it in its entirety (all 100 versions are inside the git clone directory) even though we just need a single version.

If we want to limit the cloned git repo size we need to store the large binaries outside of git. One standard choice is to use GitHub releases/packages storage. We can make a "release", attach a binary file there, and point SPM to "https://github.com/acme/myprivaterepo/releases/download/skunkworks.xcframework.zip".

This works, but it has issues for us:

• https has no authentication with SPM by default, so the repository has to become public;

• if used without authentication GitHub sometimes limits the number of downloads, and produce errors (due to API limits);

Having SSH support solves both issues, and also reuses the same authentication mechanism as the main source code repo, which makes it easy to use: set up SSH key auth once and get the project with all the binary deps via Xcode (not having to pay for what we don't need, because it only downloads binaries that are needed).

Ah, so GH releases are available using SSH auth? I didn't realize that, I thought this would be another repository.

Comment by Daniel Lazarenko (JIRA)

I'm sorry. I've checked, and GH doesn't actually support SSH for accessing releases.
It seems to only be served via HTTPS and supports 2 ways to authenticate: token-based, and basic auth.
(see also: https://stackoverflow.com/questions/20396329/how-to-download-github-release-from-private-repo-using-command-line )

What we'd really want is to be able to use SPM binaries with private repos and GitHub "releases" or GitLab "job artifacts" or such.

Since it is not related to SSH, I'm closing the issue.

If you know a workaround for us (to do auth over HTTPS with SPM), please point to some solution.

HTTP auth for fetching private binaries could be done via ~/.netrc:
https://stackoverflow.com/questions/69834361/downloading-binary-only-swift-packages-that-require-authentication