Feature Request: Automatic discovery of cran resources from source code resources

[dgkf]

Coming out of our discussion today, and specifically discussing whether we want to search for cran reverse dependencies for local package, @dominik-appsilon asked whether we want to support conversion from source code (local library / tar.gz / git / etc) resources into cran resources.

Some notes from the discussion

• There's no simple way to guarantee that a package with a given name locally is the same package that would come from CRAN. We would have to download the package from CRAN and compare the newly installed package to our local package to ensure they're identical.
  • For example, you may have an internal or local package with a given name, not realizing it is also a package on CRAN
• Ideally we'd have a record of the .tar.gz MD5 sum in the library install directory.
  • This still isn't a guarantee (since someone could have modified the local files), but this is probably a reasonable enough indicator for any controlled system to infer a CRAN source.

[dgkf]

If we did want to do this, we would:

Currently

1. (for non-installed source code) build and install the local source into a temporary library
2. re-install the package of the same name and version from CRAN
3. Ensure that the installed MD5 file for both installations is identical

Ideally

1. (for non-installed source code) build a package .tar.gz and create an MD5 checksum
2. Ensure that the MD5 checksum (the one we calculated from source, or the one stored in the current local library) is identical to the one listed on CRAN.

[llrs-roche]

How does renv or packrat solve this? They also have a hash on the lock file, but I'm not sure how and when it generated. Maybe we should learn from these projects.