Add sol2 version 3.5.0

[flip1995]

Summary

Add version: sol2/3.5.0

Motivation

This was released a few weeks ago. Let's make it available through conan.

Details

• https://github.com/ThePhD/sol2/releases/tag/v3.5.0
• ThePhD/sol2@9190880
• Is the public release still 3.3.0? ThePhD/sol2#1680

cc @ErniGH (as you most recently merged something in the sol2 dir)

---

• Read the contributing guidelines
• Checked that this PR is not a duplicate: list of PRs by recipe
• Tested locally with at least one configuration using a recent version of Conan

[CLAassistant]

All committers have signed the CLA.

[flip1995]

#26418 seems to only modify the same files because of a failed merge/rebase. So this should be fine.

[jcar87]

Thanks @flip1995

is the 3.5.0 release actually publicly documented as a release? Looking at https://github.com/ThePhD/sol2/releases, I can't see 3.5.0 listed.
I appreciate there is a tag, but in the past this has not sufficient, and we've seen library authors/maintainers use tags as a moving target before a release is official. Even the official website does not mention anything above 3.2 https://sol2.readthedocs.io/en/latest/

[flip1995]

The sol2 repo is pretty inconsistent there. Some releases are marked as releases on GitHub and some just have tags (i.e. 3.3.1, 3.2.3, 3.2.0, 3.5.0)

But looking at the links (especially the one to the 3.5.0 commit) in the description, it looks pretty official. If you want, I could also open an issue there asking, if they want to create a GitHub release.

That being said, tags in git are pretty persistent and removing one isn't something one would do often. Releases are really just a GitHub feature on top of a git tag, which doesn't provide any additional guarantees.

[flip1995]

FWIW, I just saw this: ThePhD/sol2#1680

[jcar87]

That being said, tags in git are pretty persistent and removing one isn't something one would do often.

Agreed - but in Conan Center this has happened very often: a new "release" is added in conan center because there's a matching tag upstream, and then the author changes the commit the tag points to, because the release wasn't "ready" nor public.
This puts us in a situation where we make a package available, and then down the line it stops building from source, because the URL of the source package is the same, but the contents have changes - so it fails the checksum. When we deal with a PR that changes a checksum - we need to consider whether it is legitimate or whether there is a chance the server repository or the server are compromised. Unlikely to happen - but we're not taking risks. What's more likely to happen and we have seen this, is that when re-tagging, there are breaking changes. So fixing the checksum is not enough, it can actually break downstream consumers in ways that are difficult to diagnose (Conan doesn't trigger a rebuild when the version doesn't change).

In the vast majority of cases, when a release is public, there's some piece of information beyond the mere presence of a git tag: a github release, a link in a website, a change in the readme, a tweet even - that's what I think we're not seeing here.

[flip1995]

I understand. I pinged the author of sol2 in the above issue, to make them aware that this is blocking a version bump in conan.

[flip1995]

The author recommended to use the 3.5.0 tag: ThePhD/sol2#1680 (comment)

[flip1995]

And to add even more context, here's the vcpkg PR bumping the version: microsoft/vcpkg#44662

[ErniGH]

LGTM Thanks @flip1995 for adding the new version 😄

ThePhD/sol2@v3.3.1...v3.5.0

The CI has not been built for Windows, but I tested it locally and it works. 👌

And the previous patch has already been introduced upstream.
https://github.com/ThePhD/sol2/blob/v3.5.0/include/sol/optional_implementation.hpp#L2194