"The project is out-of-sync" message appears when using a second named repository

[andrewheiss]

Using the latest GitHub version of renv (dba0079), I'm trying to add a second named repository to the lockfile for Stan-related stuff, following the instructions here. (This is possibly related to #1550.)

However, it seems that when there are two repositories in the lockfile, like this:

    "Repositories": [
      {
        "Name": "Stan",
        "URL": "https://mc-stan.org/r-packages"
      },
      {
        "Name": "CRAN",
        "URL": "https://packagemanager.posit.co/cran/latest"
      }
    ]

…I get this error, even though renv::status() says everything is fine and stable:

- The project is out-of-sync -- use `renv::status()` for details.

Here's a reproducible example (starting from a new empty project)

# Start a new renv library
renv::init()

# Add Stan's repo as a valid source
repos <- c(Stan = "https://mc-stan.org/r-packages/", CRAN = "https://packagemanager.posit.co/cran/latest")
options(repos = repos)

# Install cmdstanr; it will come from the Stan repo; all other dependencies will come from CRAN/RSPM
install.packages("cmdstanr")

# Save to lockfile
renv::snapshot()

# Make sure everything is good
renv::status()
#> No issues found -- the project is in a consistent state.

# RESTART R SESSION

#> Restarting R session...
#> 
#> - Project '~/Desktop/renv-testing' loaded. [renv 1.0.2.9000; sha: dba0079]
#> - The project is out-of-sync -- use `renv::status()` for details.

# It says it's out of sync there ↑
# But if I run renv::status() again, all is well
renv::status()
#> No issues found -- the project is in a consistent state.

If I remove the Stan repository and only use one repository entry in the lockfile and install {cmdstanr} like this:

install.packages("cmdstanr", repos = c("https://mc-stan.org/r-packages/", getOption("repos")))

…and then snapshot, I get this message, which is to be expected, since it comes from an unknown-to-renv repository:

The following package(s) were installed from an unknown source:
- cmdstanr [0.6.1]
renv may be unable to restore these packages in the future.
Consider reinstalling these packages from a known source (e.g. CRAN).

BUT when I restart R, I don't get the "The project is out-of-sync". That message only appears if the Stan repository is included in the lockfile.

[kevinushey]

Thanks for the bug report! I was able to reproduce the issue locally. Ultimately, the issue comes down to the fact that cmdstanr does not denote its source repository in the installed package's DESCRIPTION file.

Normally, packages installed from an R package repository will have an entry:

Repository: CRAN

to indicate where the package was retrieved from. Here, renv treats this as a signal that the package can be installed from CRAN. Since cmdstanr doesn't set anything like this, renv gets confused about this package's source when checking if the project is in-sync on startup.

I think I could try to improve the heuristics here so that you don't get the false-positive message on startup here, but I think it's worth addressing this in cmdstanr as well.

[andrewheiss]

Ok cool, I'll raise the issue over there and see if they can add Repository: Stan. Is there somewhere where the repository entry for the DESCRIPTION file is documented? I can't find anything about it in the official documentation, and I've only found this old discussion in packrat, pre-renv.

[kevinushey]

Strangely, I don't think it's officially documented anywhere, but the R sources do make use of it in a variety of places, e.g.

https://github.com/wch/r-source/blob/09c2fbdcab3fd4397e4e654f21222687ed71ef4b/src/library/utils/R/citation.R#L1377-L1380

The fact that Repository: CRAN is used by citation() to determine if a package was from CRAN feels like the closest thing to an official endorsement of that use.

[hutch3232]

Glad to see this issue pop-up. This was driving me a little crazy but I was trying to make a reprex before posting but wasn't able to. Now that I see what's going on, I have some additional thoughts.

It seems that install.packages is possibly adding that value to DESCRIPTION, not the maintainers. For instance, here is data.table's DESCRIPTION: https://github.com/Rdatatable/data.table/blob/master/DESCRIPTION There is no Repository instance. However, after installing it:

utils::packageDescription(pkg = "data.table", fields = "Repository")
# [1] "CRAN"

My issue is occurring because any packages installed from the renv cellar do not get a "Repository" value added to DESCRIPTION. So that is my particular problem - I see the startup message:

#> - The project is out-of-sync -- use `renv::status()` for details.
renv::status()
#> No issues found -- the project is in a consistent state.

which is caused by installing packages from the cellar which doesn't add a Repository value to DESCRIPTION. Perhaps "cellar" could be added and a relevant check included?

[kevinushey]

install.packages() does not add that field, it is added by the CRAN team after the package is submitted and released. You can confirm by looking at the DESCRIPTION file for the source package from CRAN directly.

options(repos = c(CRAN = "https://cran.r-project.org"))
info <- download.packages("data.table", destdir = tempdir())
setwd(tempdir())
untar(info[, 2])
tail(readLines("data.table/DESCRIPTION"))

You'll see:

> tail(readLines("data.table/DESCRIPTION"))
[1] "  Kevin Ushey [ctb],"                         
[2] "  Dirk Eddelbuettel [ctb],"                   
[3] "  Ben Schwen [ctb]"                           
[4] "Maintainer: Matt Dowle <mattjdowle@gmail.com>"
[5] "Repository: CRAN"                             
[6] "Date/Publication: 2023-02-17 12:20:12 UTC"   

[hutch3232]

Appreciate the correction/explanation, thank you!