Add "Yank" Feature for Individual Releases

[chadfennell]

As per @Seldaek's suggestion, I am adding a request to explore an implementation version of the "yank" feature offered on rubygems.org.

This feature does not map nicely to packagist.org, but offers some basic feature ideas that may be of use. E.g.:

• Allow users to yank previous releases such that running composer commands does not trigger an update to yanked versions (e.g. you made a botched release, prevent users from upgrading to this)
• Identify yanked versions as having been yanked on package page (but leave a download link for posterity)
• Offer a mechanism to undo a yank
• These rubygems yank features are demoed in this video

Rather than offering a CLI mechanism, these features could simply exist in the packagist UI.

While this does not solve the related Issues of package deletion: (e.g. #25 #115), it does at least offer a means to pull specific releases.

[nicolas-grekas]

Note also that it would useful to yank not only individual releases but also e.g. <2.0.0. This could be a way to fix the current scalability issue packagist is about to have (having an ever increasing list of package versions to deal with).

[naderman]

@nicolas-grekas Certainly the solution to that is not to yank all older packages that someone may still want to use somewhere? This is a solution to deleting individual botched releases, not a mechanism to delete everything but the latest release. In fact I would try and safe-guard from it being used for that so users don't get failures for no good reason. I would very much like to still be able to install a Symfony 2.0 release somewhere locally for historic or investigative debugging purposes, no need to make that impossible.

[christian-weiss]

The feature is good. But can we please have another name for it?!

"Cancel" a release: as Atlassian do (Jira, etc.).
See an example https://confluence.atlassian.com/jirasoftware/jira-software-7-0-x-release-notes-776997721.html

"Revoke" a release or version, as Hashicorp Atlas do (Vagrant boxes, virtual machines).
Documentation: https://atlas.hashicorp.com/help/vagrant/boxes/lifecycle

[naderman]

I'd prefer cancel or revoke, too.