Renv won't hydrate packages listed in the DESCRIPTION

[8BitTeacup]

I work in an organisation that requires vetting of software before use. We need to use Apache Arrow for a project, however cannot install it normally as it tries to install c++ dependencies from the open internet which is blocked. We've been provided with an image that contains arrow in the site-library, with it's dependencies already installed. I've noticed that to hydrate arrow from the site-library to the project's cache, it can't be present in the DESCRIPTION. I had a look at the source code and ctrl-f "DESCRIPTION" and it seems it is used for versioning. I tried update='all' as that should just immediately return true for the filter but that doesn't work.

Here is an example with arrow in the description:

root@89e6afa22844:/code# cat DESCRIPTION 
Package: package
Title: title
Version: 0.0.0.9000
License: 'use_proprietary_license()'
Encoding: UTF-8
Depends:
    arrow
root@89e6afa22844:/code# R

R version 4.3.2 (2023-10-31) -- "Eye Holes"
Copyright (C) 2023 The R Foundation for Statistical Computing
Platform: x86_64-pc-linux-gnu (64-bit)

R is free software and comes with ABSOLUTELY NO WARRANTY.
You are welcome to redistribute it under certain conditions.
Type 'license()' or 'licence()' for distribution details.

  Natural language support but running in an English locale

R is a collaborative project with many contributors.
Type 'contributors()' for more information and
'citation()' on how to cite R or R packages in publications.

Type 'demo()' for some demos, 'help()' for on-line help, or
'help.start()' for an HTML browser interface to help.
Type 'q()' to quit R.

- Project '/code' loaded. [renv 1.0.7]
- None of the packages recorded in the lockfile are currently installed.
- Would you like to restore the project library? [y/N]: n

> renv::hydrate('arrow')
The following packages were discovered:

# /usr/local/lib/R/site-library ----------------------------------------------
- assertthat   0.2.1
- bit          4.0.5
- bit64        4.0.5
- cli          3.6.2
- cpp11        0.4.7
- glue         1.7.0
- lifecycle    1.0.4
- magrittr     2.0.3
- purrr        1.0.2
- R6           2.5.1
- rlang        1.1.3
- tidyselect   1.2.0
- vctrs        0.6.5
- withr        3.0.0

They will be linked into the project library.

The following packages are used in this project, but not available locally:
- arrow
renv will attempt to download and install these packages.

Now if I remove it:

root@89e6afa22844:/code# cat DESCRIPTION 
Package: package
Title: title
Version: 0.0.0.9000
License: `use_proprietary_license()'
Encoding: UTF-8
root@89e6afa22844:/code# R

R version 4.3.2 (2023-10-31) -- "Eye Holes"
Copyright (C) 2023 The R Foundation for Statistical Computing
Platform: x86_64-pc-linux-gnu (64-bit)

R is free software and comes with ABSOLUTELY NO WARRANTY.
You are welcome to redistribute it under certain conditions.
Type 'license()' or 'licence()' for distribution details.

  Natural language support but running in an English locale

R is a collaborative project with many contributors.
Type 'contributors()' for more information and
'citation()' on how to cite R or R packages in publications.

Type 'demo()' for some demos, 'help()' for on-line help, or
'help.start()' for an HTML browser interface to help.
Type 'q()' to quit R.

- Project '/code' loaded. [renv 1.0.7]
- None of the packages recorded in the lockfile are currently installed.
- Would you like to restore the project library? [y/N]: n

> renv::hydrate('arrow')
The following packages were discovered:

# /usr/local/lib/R/site-library ----------------------------------------------
- arrow        14.0.2.1
- assertthat   0.2.1
- bit          4.0.5
- bit64        4.0.5
- cli          3.6.2
- cpp11        0.4.7
- glue         1.7.0
- lifecycle    1.0.4
- magrittr     2.0.3
- purrr        1.0.2
- R6           2.5.1
- rlang        1.1.3
- tidyselect   1.2.0
- vctrs        0.6.5
- withr        3.0.0

They will be linked into the project library.

Do you want to proceed? [Y/n]: n

- Operation canceled.

[kevinushey]

Thanks for the bug report -- looks like this is coming unintentionally from

renv/R/hydrate.R

Lines 93 to 95 in d6bced3

	# also consider remotes; treat these as 'missing' so we always try to install them
	remotes <- renv_project_remotes(project = project, resolve = TRUE)
	missing[map_chr(remotes, `[[`, "Package")] <- ""

.

[kevinushey]

This should now be resolved in the development version of renv -- thanks for reporting!