search

rstudio / packrat

Packrat is a dependency management system for R
http://rstudio.github.io/packrat/
401 stars 89 forks source link

do not assume CRAN for packages without Repository information #576

Open aronatkins opened 4 years ago

aronatkins commented 4 years ago

A CRAN-like repository may not annotate DESCRIPTION records with the Repository field. Packrat incorrectly assumes that these packages are from CRAN.

https://github.com/rstudio/packrat/blob/29a4fdcb5d34113222b73e4eb2affd0e3fc3f1fd/R/pkg.R#L114-L124

This code produces warnings of the form:

1: In FUN(X[[i]], ...) : 
Package 'MYPACKAGE 0.2-7.5' was installed from sources; Packrat will assume this package is available from a CRAN-like repository during future restores

This warning is presented without searching for the package in the set of available.packages. Given the contrib.url in available.packages, packrat could determine the name of the repository as specified in the repos option.

The fallback code here is using available.packages but assuming that all packages in this set are CRAN packages:

https://github.com/rstudio/packrat/blob/29a4fdcb5d34113222b73e4eb2affd0e3fc3f1fd/R/pkg.R#L126-L144

The rsconnect package does a variation of this renaming here: https://github.com/rstudio/rsconnect/blob/90bf6cde2bf6f12484fd89d866363d4b78cc483d/R/dependencies.R#L106-L123 The rsconnect code does not rename the repository record when packrat indicates the package comes from CRAN (because CRAN is a well-known name).

The packrat package analysis probably doesn't need to be as conservative as rsconnect. Maybe:

  1. preserve Repository: CRAN in DESCRIPTION.
  2. preserve repos = c(CRAN = cranURL) as CRAN.
  3. attempt to discover the true repository for any package without Repository in DESCRIPTION.
aronatkins commented 4 years ago

Related: https://github.com/rstudio/packrat/issues/528, https://github.com/rstudio/packrat/issues/371