[question] are there any plans for standard lockfile storage through conan?

[DukeOfKirkcaldy]

For packages which have version ranges in the recipe, to be able to reproduce or patch historic builds , the lockfile must be available from somewhere.

Are there any plans from conan's side for having built in support for this? If so, how might this look...?

For example,

• would conan commands to rebuild a specific version use an existing lockfile by default?
• would lockfiles sit alongside the package in the remote repo, or have their own 'generic' repo, such as the artifactory-build-info repo?
• is there a rough timeline?

Thanks!

[memsharded]

Hi @GordonJess

Yes, there has been discussions around this. The summary is:

• Yes, the lockfiles might eventually be stored in the package binaries.
• They are not stored now, because the feature is still experimental, lockfiles are versioned (we are already in the 0.3 version) because they evolve (breaking). Putting them into packages can be very problematic and make impossible to keep developing the feature without breaking
• The current recommendation right now is to store them (a good place would be an Artifactory generic repo), associated with the CI job that built it. It is typically good enough to have one lockfile for a whole build, that can include re-building multiple dependant packages.
• We might learn that lockfiles are indeed something bigger than a package, and then not put them directly into package binaries, but somewhere else. An example is that building a binary as a result of some bigger build of the whole dependency graph will have a lockfile that includes consumer of that package, and it would be weird to store that in the package.

There is no timeline for this yet. The current model putting them in Artifactory generic repos seems to work well enough in practice, and there are still a lot of things to stabilize in the lockfiles functionality, and also defining the overall CI flows, the best practices, etc. I estimate that this will be discussed again after Conan 2.0, which means at least the end of the year.

[memsharded]

Please track #10261