[question] Requirements - combine private and override

[MichalCermakx]

What is your question?

Hi!

I have a question about combining private and override. Here is a minimal example:

1. It is shown on top of the example from here: https://docs.conan.io/en/latest/versioning/introduction.html#dependencies-overriding
2. There are 4 combinations of requirement definitions to consume pkga: a. 'pkga/2.0' b. ('pkga/2.0','override'), c. ('pkga/2.0','private'), d. ('pkga/2.0','override', 'private'),

ad a. - This works perfectly fine and it is printing a warning

WARN: pkgb/1.0: requirement pkga/1.0 overridden by pkgd/1.0 to pkga/2.0

ad b. - works exactly same as a. ad c. - Throws an error:

ERROR: Conflict in pkgd/1.0:
    'pkgd/1.0' requires 'pkga/2.0' while 'pkgb/1.0' requires 'pkga/1.0'.
    To fix this conflict you need to override the package 'pkga' in your root package.

ad d. - Finish without error, but uses pkga/1.0.

I have an issue with point d. If I correctly understand the implementation, when you define dependency as private, it is not considered during dependency resolution. But in my use case, I need to hide a particular dependency (Therefore defining this as private), but I want to use it to override dependency. In other words, I need to override to pkga/2.0. Is there any way to achieve this?

Minimal example with logs. Please update PkgD\conanfile.py to check different variants. ConanPrivateOverride.zip

Thanks, Michal

• Operating System+version: Windows 10, 21H2
• Compiler+version: N/A
• Conan version: Conan 1.57.0
• Python version: 3.10.6

Have you read the CONTRIBUTING guide?

• [x] I've read the CONTRIBUTING guide

[Ahajha]

This seems somewhat related to another issue I had: https://github.com/conan-io/conan/issues/12274

[MichalCermakx]

It seems to be different. Mine is about private+override, the https://github.com/conan-io/conan/issues/12274 is about the combination of a build_requires and requires.

[adnan-ali1]

Any update on this issue ?

[memsharded]

Hi all,

override and private are mutually exclusive:

• override means that you don't really depend on it, but that some of your transitive dependencies does, and you want to change the version
• private means that it is your direct, private dependency. It is a highly discouraged thing in Conan 1.X, it should only be used as a very last resource.
• overriding a transitive dependency that is declared private by its consumer defining the requires to it, is violating the private definition, which means exactly "this is my own private thing, nobody else can touch it", so it cannot be overriden by downstream.

Both are incompatible in meaning and cannot be used together.

[adnan-ali1]

@memsharded Thanks this explains alot, but as a developer you know the internals and hence can answer this here. but official documentation does not states this.

A few questions ( feel free to answer or not )

1. Why is private discouraged ? if this is a feature for developers or users of conan then it should be usable. I always see it is discouraged, doesn't state exactly why ? is it the case that internal implementation is not rock solid around it ?
2. What would be alternate of private dependency ? lets say I want to combine different packages which are sort of a diamond dependency graph and are built with different compilers e.g. as an archive but using conan so that the graph can be created
3. Alternate to private dependency in Conan 2.0 ?

[memsharded]

but official documentation does not states this. I think the only mention about this feature in the docs is this paragraph:

Why is private discouraged ? if this is a feature for developers or users of conan then it should be usable. I always see it is discouraged, doesn't state exactly why ? is it the case that internal implementation is not rock solid around it ?

Yes, too many rough edges. It was a very ancient thing, that couldn't work with the 1.X dependency resolution and the rest of the tooling. It is still there for legacy reasons, because in 1.X it cannot be removed, so the best that can be done is to discourage its usage. Not every feature in the codebase should be usable, many things become legacy and deprecated overtime, very discouraged to be used, but not fully removed.

What would be alternate of private dependency ? lets say I want to combine different packages which are sort of a diamond dependency graph and are built with different compilers e.g. as an archive but using conan so that the graph can be created

Not sure what is the use case. If you have a diamond of static libraries, then private really doesn't make sense, it is not possible at all. Building things with different compilers will also produce binary incompatibilities and linking problems.

Alternate to private dependency in Conan 2.0 ?

requires(..., visible=False) trait. It will still not allow to override that dependency, if you declare it invisible for your consumers, then your consumers cannot override it. But otherwise it is a way better implementation and management of this trait in 2.0.