Re: [Caml-list] opam and versions

[Thomas Gazagnaire <thomas@ocamlpro.com>]

Hi Jon,

> For our purposes, we need to be able to ensure that our builds are reproducible, and hence need to know exactly which versions are installed. We had hoped to achieve this by removing or disabling packages whose sources were got directly from a master branch in github. However, it turns out that some packages that are 'stable' are dependent upon these packages, which seems brittle. The question is how to fix it? Should the opam repository maintainers require that 'stable' packages aren't dependent on 'unstable' ones? Should opam itself be aware of the difference and enforce this policy? If someone really wants to release a stable version of their thing and it's dependent upon an upstream project with only a github repo, should the developer engage the upstream devs and request at least a tag, or should they make their own tarball/github fork?

Before the 1.0 release my plan is:
* to remove the unstable packages in the main opam-repository (ie. every packages should have a stable tarball with a fixed checksum) [1]
* add a way to specify commits/branches for unstable packages if needed. [2]

The current workaround is, as Anil pointed out, to clone opam-repository, use 'opam-mk-repo' at its root to generate a local mirror of opam.ocamlpro.com, and tell opam to add the local repository as a remote:  'opam remote -add local /path/to/your/local/repository'

Then 'opam remote -list' should display the list of repositories and their respective priority (higher is better). You can also tweak ~/.opam/repo/index manually to tell opam to use your local repository only for some packages, for instance the unstable ones (don't forget to run 'opam update' after changing the index file).

For [1], I'm gladly accepting external contributions (for [2] as well actually if someone really wants to hack into opam).

--
Thomas

[1] https://github.com/OCamlPro/opam-repository/issues/171
[2] https://github.com/OCamlPro/opam/issues/267