MRAN repository snapshots were deleted - Failing jobs because packages can't be found anymore

[victor-mariano-leite]

Recently in my company we've made some builds in R jobs, and started failing out of nowhere.

I've noticed rocker old images like for 3.5.3 packages are pointing to a repository with no package for installing anymore, MRAN's snapshots mainly, and these were deleted 30/05/2023 it seems.

Warning in main page says "The Microsoft R Application Network website will be shut down on July 1st, 2023.", so if many of the base images of "rocker" uses this repository, it might be important to migrate to another one that fulfills it's purpose.

In my company we had to point to cran repository manually in "install.packages", since our base images uses rocker, and had to search manually for compatible packages, since MRAN had many available that officially are not anymore.

[eitsupi]

Hi, thank you for using Rocker images!

Using P3M (Posit Public Package Manager, formerly called RSPM) via the pak package may be a solution https://pak.r-lib.org/reference/get-started.html?q=date#time-travel-using-rspm

For example, it seems to be possible to install a package with the date set to rocker/r-ver:3.5.3 as follows

> pak::repo_add(CRAN = "RSPM@2019-04-26")

> pak::pak("dplyr")
✔ Updated metadata database: 2.14 MB in 7 files.
✔ Updating metadata database ... done

→ Will install 1 package.
→ Will update 1 package.
→ Will download 1 CRAN package (1.08 MB).
→ Will download 1 package with unknown size.
+ BH            1.69.0-1 [dl]
+ dplyr 1.1.0 → 0.8.0.1  [bld][cmp][dl] (1.08 MB)

? Do you want to continue (Y/n)

[victor-mariano-leite]

Thank u a lot! It solved for us this, didn't knew about the pak package, very useful!

[victor-mariano-leite]

Maybe you guys could back port with this strategy, works very well, and I don't think I'm the only one who got this problem...

[eitsupi]

Glad to hear it worked out.

---

Unfortunately, backporting is not an easy task.

1. Those base images are based on old Debian, that are no longer supported. Should we continue to use old Debian? Or should we do updates that may break compatibility?
2. The infrastructure used for the build at that time is no longer available, so the build configuration must be done from scratch.

@cboettig Any idea?

[cboettig]

I think in general it will be difficult to support rebuilding images from their original sources using a Dockerfile beyond the lifetime of those constituent components (debian base image, upstream repos, etc). Retaining pre-built images rather than attempting to continually re-build the images from Dockerfile commands past the lifetime of the upstream repos is probably the most general strategy, though for some cases users may be able to work around it with pak (e.g. for the period in which MRAN and pak overlap, or if dependency chain is simple enough to reconstruct manually, e.g. with devtools::install_version() building from archived versions of packages on any CRAN mirror).

We do strive for version-stable reproducible, but this is more of an orchestration process of upstream options -- i.e. since 4.x, the version-stable stack including RStudio builds on ubuntu LTS releases that have at least a 10 year support window. (guess we will see if RSPM / P3M has a longer lifetime than MRAN).