Context

Laravel apps often use Memcached for cache and sessions. memcached.org publishes release tarballs with only a SHA-1 and no signature, and there's no official Windows build. The Windows builds that exist are either years out of date or publish no checksums, so none meet Short Leash's rule that every download is verified.

Decision

macOS. Short Leash installs memcached from its own builds (0017, 0019):
- ShortLeash/runtimes builds memcached 1.6.45 with libevent 2.1.13 linked in, for both Mac architectures.
- The memcached tarball is checked against a pinned SHA-256 and memcached.org's SHA-1. libevent is checked against GitHub's release digest.
- The build links only macOS's own libraries, and answers a set and a get before it's published.
- Short Leash downloads it through the signed manifest and checks its SHA-256.
Running. memcached -l 127.0.0.1 -p <port> -U 0 -m 64 -c 1024 -v: loopback only (memcached listens on every interface by default), and UDP off.
Windows. Memcached shows as not available on Windows yet.

Consequences

Mac users get Memcached without Xcode's tools or a local build.
Windows users use Garnet or a database cache instead, for now.
This changes when upstream merges its MSVC port, or when ShortLeash/runtimes builds memcached and PHP's memcached extension for Windows itself.