TeX Live local repository configuration for package version pinning

Restricting TeX Live to a Local Repository

To restrict all package operations to a local directory and prevent tlmgr from connecting to external CTAN mirrors, use the option repository command. This redirects the package manager to a specific local path containing the TeX Live repository structure.

tlmgr option repository /path/to/local/repository

To verify that the configuration is active and pointing to the correct local path, run:

tlmgr option show repository

Reproducible Package Sets and Dependencies

Because TeX Live does not utilize a native lockfile (like package-lock.json or Gemfile.lock), achieving reproducibility requires a manual strategy for capturing and distributing the package set.

Recursive Dependencies

A reproducible package set must include recursive dependencies. The LaTeX engine resolves files by name at runtime; if a pinned package depends on a newer or different version of a utility package not present in your local repository, the compilation will fail or produce inconsistent output.

Exporting the Set

Since tlmgr cannot export a "snapshot" of current versions into a portable lockfile, the standard method for exporting a pinned set is to create a local mirror of the texmf-dist tree. This involves:

• Identifying the required packages and their recursive dependencies.
• Downloading the specific versions of these packages into a directory structure that mimics the CTAN mirror.
• Distributing this directory to contributors, who then point their tlmgr to this local path.

Handling Missing Dependencies

TeX Live is strictly bound to its release year. If a package in your local repository depends on a component that is unavailable within that same release year's repository, tlmgr will fail to install the package.

The package manager will not automatically search other release years or external mirrors to resolve the conflict if the repository is restricted. This ensures that you do not accidentally introduce "version drift" by mixing packages from different years, which often leads to binary incompatibilities or broken macros.

Verification Steps

To confirm your environment is fully isolated and pinned:

1. Disconnect from the network or use a firewall to block CTAN access.
2. Run tlmgr install [package-name] to ensure it pulls only from the local path.
3. Run tlmgr info --list to verify that the installed versions match your intended pinned versions.

Diagnostic Note: Please specify if your environment uses a "scheme-basic" or "scheme-full" installation, as this determines whether you must manually pin the core TeX Live distribution packages or only the additional CTAN packages.