Inaccurate "duplicate" banner on r-universe repo page

[francisbarton]

Hi

If I visit https://cynkra.r-universe.dev/tv there is a banner at the top saying "This package is considered a duplicate."

However the repository linked to in the banner (https://eheinzen.r-universe.dev/tv) is not the same package at all. Something wrong with the logic used to trigger the banner message?

[jeroen]

I think it is working as intended. Both packages have the same name, and we treat the one that is on CRAN as the official version. We warn users against this because R will automatically overwrite one package with the other when running install.packages or update.packages. This becomes a total mess when other packages import(tv).

So cynkra probably will have to rename their package, or try to convince the other maintainer to remove their tv from CRAN.

[noamross]

Perhaps we should change the text to read something like, "This package has an identical name to another and may be a duplicate. packages with the same name are found in other universes: https://eheinzen.r-universe.dev/tv (on CRAN)"

[jeroen]

I'm not sure if that is strong enough to warn users against 3rd party universes with fake/old versions of common CRAN packages...

[wlandau]

I'm getting this in the R-multiverse Community repo:

In my case, jagstargets 1.2.3 at https://community.r-multiverse.org/jagstargets is a release, whereas the version in https://ropensci.r-universe.dev/jagstargets is development. Duplication is not a bad thing here. It's a minor point, but the banner as currently written might be counterintuitive for R-multiverse users.

[jeroen]

We have to think about this a little how to identify the official home of the package. In this case we can just turn of the warnings off for multiverse because it is a trusted source. But in the general case when folks host a copy or fork of a package from another owner, we want to make sure the user sees this.

[jeroen]

It is also relevant deduplicating by the search engine. Should we show jagstargets from ropensci or multiverse or multiverse-staging in the search results? I don't think it's a good idea to show 3 copies of the same package.

[noamross]

I has thinking that maybe putting the r-universe URL in DESCRIPTION could do it, but I could also fork a package to another universe and change that value while still keeping the name the same. There are a few scenarios - a package author wants to designate which universe is the canonical one for their package, two authors could create packages with the same name, or someone could fork a package to their for their own purposes, possibly changing it. In the first case, the author could somehow designate an "official" version and also ones to suppress in metadata somehow, but two packages with the same name (though not good practice), may both want to show up in search.

[jeroen]

The exact deduplication rules are a too complex for this discussion, but currently we use CRAN, Bioc, and rOpenSci as official sources. So if you publish a package with the same name as a CRAN package it is not shown.

As I said above, R has only one package library so overwriting a CRAN package (that other things may depend on) with something else is a bit worse than just "bad practice" imo :)