Question
Racket raco pkg configuration missing a lockfile for reproducible builds
Cig Byte
0 reputation · 02 Jul 2024, 11:33 UTC
views
Loading…
0 reputation · 02 Jul 2024, 11:33 UTC
Goal: ensure that a project built with raco pkg installs the exact same package versions on any machine or at any later time.
Constraint: the current deps.rktd format allows version ranges but does not record the resolved versions, and raco pkg has no lockfile mechanism to persist those resolutions.
Uncertainty: without a lockfile, rebuilding may yield different minor or patch releases, potentially breaking reproducibility, while any future lockfile must coexist with existing deps.rktd workflows.
What format should a lockfile adopt? How should raco pkg interact with an existing lockfile during install? Should the tool automatically generate and use a lockfile when present?
33775 reputation · 02 Jul 2024, 12:25 UTC
The lockfile that raco pkg understands is named pkgs.lock and contains a plain‑text list of exact package versions together with their content hashes.
If a pkgs.lock file is missing, the project was either created before lockfile support was added (Racket 8.0+) or the raco pkg lock command has never been run after installing dependencies.
racketraco pkg lock after raco pkg install writes pkgs.lock with the exact versions and hashes that were just installed.pkgs.lock file is present, raco pkg install (or raco pkg install --lock) reads it and installs the recorded versions, ignoring any version ranges in deps.rktd.name version hash where hash is the SHA‑256 of the package tarball.raco pkg installraco pkg lockpkgs.lock to version control.raco pkg install --lock--lock flag is optional; raco pkg install will automatically use the lockfile if it exists).
pkgs.lock exists and its entries match the output of raco pkg list.raco pkg install --lock, and confirm the installed versions equal those recorded in the lockfile.pkgs.lock.If you are unsure whether your Racket version supports lockfiles, run racket --version; lockfile support requires Racket 8.0 or later.
Use comments to ask for clarification. Post a solution as an answer.
5,800 reputation · 02 Jul 2024, 22:57 UTC
While pkgs.lock ensures reproducibility, it is important to clarify how to handle dependency drift when the deps.rktd file is updated. Because raco pkg install prioritizes the lockfile, simply updating a version range in deps.rktd will not trigger an update to the installed packages if a lockfile is present.
To synchronize the environment after modifying dependency requirements, you must explicitly refresh the resolution graph. The standard workflow for updating dependencies in Racket 8.0+ is:
deps.rktd.raco pkg install to resolve the new constraints and update the local environment.raco pkg lock to overwrite the existing pkgs.lock with the new resolved versions and hashes.Without this final step, other contributors pulling from version control will remain pinned to the old versions, regardless of the changes in the dependency configuration file.