[Rpm-maint] [rpm-software-management/rpm] Introduction of "rpms.lock.yaml" file (Discussion #2908)

[Vít Ondruch]

Right, RPM does not have any concept of repos. As it mostly does not care about URLs and generally does not care about where the RPM comes from. But let me explain what I mean.

This lock file (based on your initial example, and sorry if I don't have the YAML syntax right) in the simplest form could be interesting for RPM IMHO:

~~~yaml
lockfileVersion: 1
packages:
  - vim-enhanced-9.1.031-1.fc38.x86_64.rpm
  - vim-common-9.1.031-1.fc38.x86_64.rpm
  - vim-filesystem-9.1.031-1.fc38.noarch.rpm
  - gpm-libs-1.20.7-42.fc38.x86_64.rpm
  - ...
~~~

If I did `rpm -I vim-enhanced-10.0.038-1.fc38.x86_64.rpm`, the command would fail, because the NVR does not match the lock file. If I did `rpm -I foo`, this wold also fail, because `foo` package is not listed in the lock file. But doing `rpm -I vim-enhanced-9.1.031-1.fc38.x86_64.rpm` would work.

On top of that, if the command would be `rpm -I https://mirrors.nic.cz/pub/fedora/linux/updates/38/Everything/x86_64/Packages/v/vim-enhanced-9.1.031-1.fc38.x86_64.rpm` RPM could also check the URL if it was part of the lock file as in your initial proposal.

IOW this would allow version pinning which could probably be useful RPM feature.

-- 
Reply to this email directly or view it on GitHub:
https://github.com/rpm-software-management/rpm/discussions/2908#discussioncomment-8527930
You are receiving this because you are subscribed to this thread.

Message ID: <rpm-software-management/rpm/repo-discussions/2908/comments/8527930 at github.com>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.rpm.org/pipermail/rpm-maint/attachments/20240220/3a18879a/attachment-0001.html>