do not assume CRAN for packages without Repository information

[aronatkins]

A CRAN-like repository may not annotate DESCRIPTION records with the Repository field. Packrat incorrectly assumes that these packages are from CRAN.

packrat/R/pkg.R

Lines 114 to 124 in 29a4fdc

	# If we don't know the package source, but the user has opted in
	# to CRAN fallback, then warn the user and update the inferred source.
	if (fallback.ok && result$source == "unknown") {
	fmt <- paste(
	"Package '%s %s' was installed from sources;",
	"Packrat will assume this package is available from",
	"a CRAN-like repository during future restores"
	)
	warning(sprintf(fmt, pkgName, result$version))
	result$source <- "CRAN"
	}

This code produces warnings of the form:

1: In FUN(X[[i]], ...) : 
Package 'MYPACKAGE 0.2-7.5' was installed from sources; Packrat will assume this package is available from a CRAN-like repository during future restores 

This warning is presented without searching for the package in the set of available.packages. Given the contrib.url in available.packages, packrat could determine the name of the repository as specified in the repos option.

The fallback code here is using available.packages but assuming that all packages in this set are CRAN packages:

packrat/R/pkg.R

Lines 126 to 144 in 29a4fdc

	} else if (fallback.ok && pkgName %in% rownames(available)) {
	# The package is not currently installed, but is available on CRAN.
	# Snapshot the latest available version for this package from CRAN.
	warning("Failed to infer source for package '", pkgName, "'; using ",
	"latest available version on CRAN instead")
	# Construct the package record by hand -- generate the minimal
	# bits of the DESCRIPTION file, and infer the package record
	# from that.
	pkg <- available[pkgName,]
	df <- data.frame(
	Package = pkg[["Package"]],
	Version = pkg[["Version"]],
	Repository = "CRAN"
	)
	result <- suppressWarnings(inferPackageRecord(df, available))
	} else {

The rsconnect package does a variation of this renaming here:
https://github.com/rstudio/rsconnect/blob/90bf6cde2bf6f12484fd89d866363d4b78cc483d/R/dependencies.R#L106-L123
The rsconnect code does not rename the repository record when packrat indicates the package comes from CRAN (because CRAN is a well-known name).

The packrat package analysis probably doesn't need to be as conservative as rsconnect. Maybe:

1. preserve Repository: CRAN in DESCRIPTION.
2. preserve repos = c(CRAN = cranURL) as CRAN.
3. attempt to discover the true repository for any package without Repository in DESCRIPTION.

[aronatkins]

Related: #528, #371