"true" source via name / DID

[norcross]

based on the discussion in the July 17th TSC meeting we need to work through how to handle when the same plugin has two separate DIDs based on where it's generated.

example:

1. a user creates a DID for a plugin they host on GitHub
2. a8c creates a DID for the same plugin, but the dot org repo

a few other examples were discussed on the meeting, but it's something regardless we need to get it nailed down.

[chuckadams]

If they're two different IDs resolving to two different URLs, by what criteria what are we determining that they're the same plugin? Slug? File Hash? The former is a stable id, the second will change with each version. If it's the same slug, then we're talking about a namespacing issue, and it comes down to arbitration of namespaces. With most namespaced package managers, it's first-come first-served then a dispute resolution process.

There's still what to do if one tries to install both, but that's a whole other barrel of monkeys.

[joedolson]

"Same plugin" is a fairly difficult question. A file hash can return a different result because of trivial differences, but the plugin is still fundamentally the same plugin; alternatively, the slug can be the same but contain radically different code.

I think we have to assume that DIDs represent unique plugins, and there's no resolution of this at that stage.

The slug comparison matters, because we don't want to overwrite an existing directory and we can't assume that a plugin will work correctly if we change its directory. (Yes, obviously they should, but they definitely won't always...)

At the slug level, we do need to have some kind of arbitration to avoid problems, since there could be significant problems at the user end.

[afragen]

Installation of a FAIR package via the FAIR plugin will always create a folder of slug-did_hash in wp-content/plugins and presumably wp-content/themes.

Therefore no over-writing should occur. Installing 2 versions of the same code will likely have other issues. No preventing that.