feat: use DLoad to download binaries

.gitattributes

@@ -20,3 +20,7 @@
 /src/**          -export-ignore
 /bin             -export-ignore
 /bin/**          -export-ignore
+
+# The empty DLoad config passed to `dload get --config`.
+/resources       -export-ignore
+/resources/**    -export-ignore

README.md

@@ -75,4 +75,16 @@ See the [RoadRunner documentation](https://docs.roadrunner.dev) for the configur
 
 ### Common options
 
-The binary commands accept `--filter` (`-f`, version constraint), `--stability` (`-s`), `--os` (`-o`), `--arch` (`-a`) and `--location` (`-l`, target directory) options. Releases are fetched from the GitHub API; set the `GITHUB_TOKEN` environment variable to avoid its rate limits, and `RR_GITHUB_API_URL` to use another API endpoint (GitHub Enterprise, a mirror; defaults to `https://api.github.com`).
+The binary commands accept `--filter` (`-f`, version constraint; for `get-binary` and `download-protoc-binary` `*` means `>=3.0 <2000` and any other `||` alternative without an upper bound gets `<2000`, so the calendar releases have to be named explicitly, e.g. `2025.*` or `>=2025`), `--stability` (`-s`), `--os` (`-o`), `--arch` (`-a`) and `--location` (`-l`, target directory) options. `get-binary` and `download-protoc-binary` download the binaries with [DLoad](https://github.com/php-internal/dload); a project's `dload.xml` does not affect them.
+
+On a musl host such as Alpine they install the musl build of Linux on their own, even with `--os=linux`; `--os=unknown-musl` forces the musl build from any host.
+
+DLoad comes with its own `vendor/bin/dload` and keeps a version registry in the user cache: `~/.cache/dload`, `$XDG_CACHE_HOME/dload` when that is set, `%LOCALAPPDATA%\dload\cache` on Windows. `DLOAD_CACHE_DIR` moves it, `DLOAD_CACHE_TTL=0` turns it off.
+
+Releases are fetched from the GitHub API at `RR_GITHUB_API_URL`, `https://api.github.com` by default. For `get-binary` and `download-protoc-binary` it is either `https://api.github.com` or a GitHub Enterprise Server API URL ending with `/api/v3` (e.g. `https://ghe.example.com/api/v3`); `versions` also accepts a mirror.
+
+All commands pick the API token the same way, to avoid the rate limits:
+
+- the public GitHub gets `DLOAD_TOKEN_GITHUB_COM`, or `GITHUB_TOKEN` when that one is not set;
+- any other server gets only its own `DLOAD_TOKEN_<HOST>`: the host upper-cased, `.` as `_`, `-` as `__`, a non-default port after `___` (e.g. `DLOAD_TOKEN_GHE_EXAMPLE_COM`, `DLOAD_TOKEN_GHE_EXAMPLE_COM___8443`); `GITHUB_TOKEN` never leaves the public GitHub;
+- over plain `http` a token is sent only to a loopback host, and it is never carried over a redirect to another host.

composer.json

@@ -39,13 +39,12 @@
     ],
     "require": {
         "php": ">=8.2",
-        "ext-json": "*",
         "composer-runtime-api": "^2.0",
         "composer/semver": "^3.4",
+        "internal/dload": "^1.19.0",
         "roadrunner/worker": "^3.8",
-        "spiral/tokenizer": "^2.13 || ^3.15",
-        "symfony/console": "^5.3 || ^6.0 || ^7.0 || ^8.0",
-        "symfony/http-client": "^4.4.51 || ^5.4.49 || ^6.4.17 || ^7.2 || ^8.0",
+        "symfony/console": "^6.4 || ^7.0 || ^8.0",
+        "symfony/http-client": "^6.4.17 || ^7.2 || ^8.0",
         "symfony/yaml": "^5.4.49 || ^6.4.17 || ^7.2 || ^8.0"
     },
     "require-dev": {

psalm.xml

@@ -8,15 +8,13 @@
     resolveFromConfigFile="true"
     findUnusedPsalmSuppress="true"
     findUnusedBaselineEntry="true"
-    findUnusedCode="false"
+    findUnusedCode="true"
     findUnusedVariablesAndParams="true"
     ensureArrayStringOffsetsExist="true"
     addParamDefaultToDocblockType="true"
 >
     <issueHandlers>
         <MissingClassConstType errorLevel="suppress" />
-        <!-- Making public classes final would break BC for users who extend them -->
-        <ClassMustBeFinal errorLevel="suppress" />
     </issueHandlers>
     <projectFiles>
         <directory name="src" />

resources/dload.xml

@@ -0,0 +1,3 @@
+<?xml version="1.0"?>
+<!-- Intentionally empty: see Spiral\RoadRunner\Console\Internal\Downloader\DLoadDownloader -->
+<dload/>