warn if the matched package is retired, skip prerelease (#1897)

retired packages are now used the same as any other but
a warning will be printed when it is resolved.

prerelease versions are skipped unless explicitly given
as the version in the constraint or lock file.

3 files changed, 58 insertions, 33 deletions

diff --git a/src/rebar.hrl b/src/rebar.hrl
index 572cbe8..f11302d 100644
--- a/src/rebar.hrl
+++ b/src/rebar.hrl
@@ -27,9 +27,9 @@
 -define(REMOTE_PACKAGE_DIR, "tarballs").
 -define(LOCK_FILE, "rebar.lock").
 -define(DEFAULT_COMPILER_SOURCE_FORMAT, relative).
--define(PACKAGE_INDEX_VERSION, 4).
--define(PACKAGE_TABLE, package_index_v4).
--define(INDEX_FILE, "packages-v4.idx").
+-define(PACKAGE_INDEX_VERSION, 5).
+-define(PACKAGE_TABLE, package_index).
+-define(INDEX_FILE, "packages.idx").
 -define(HEX_AUTH_FILE, "hex.config").
 -define(PUBLIC_HEX_REPO, <<"hexpm">>).
 
diff --git a/src/rebar_app_utils.erl b/src/rebar_app_utils.erl
index 35e908c..fb08ea9 100644
--- a/src/rebar_app_utils.erl
+++ b/src/rebar_app_utils.erl
@@ -254,10 +254,13 @@ update_source(AppInfo, {pkg, PkgName, PkgVsn, Hash}, State) ->
         {ok, Package, RepoConfig} ->
             #package{key={_, PkgVsn1, _},
                      checksum=Hash1,
-                     dependencies=Deps} = Package,
-            AppInfo1 = rebar_app_info:source(AppInfo, {pkg, PkgName, PkgVsn1, Hash1, RepoConfig}),
+                     dependencies=Deps,
+                     retired=Retired} = Package,
+            maybe_warn_retired(PkgName, PkgVsn1, Hash, Retired),
+            PkgVsn2 = list_to_binary(lists:flatten(ec_semver:format(PkgVsn1))),
+            AppInfo1 = rebar_app_info:source(AppInfo, {pkg, PkgName, PkgVsn2, Hash1, RepoConfig}),
             AppInfo2 = rebar_app_info:update_opts_deps(AppInfo1, Deps),
-            rebar_app_info:original_vsn(AppInfo2, PkgVsn1);
+            rebar_app_info:original_vsn(AppInfo2, PkgVsn2);
         not_found ->
             throw(?PRV_ERROR({missing_package, PkgName, PkgVsn}));
         {error, {invalid_vsn, InvalidVsn}} ->
@@ -269,10 +272,10 @@ update_source(AppInfo, Source, _State) ->
 %% @doc convert a given exception's payload into an io description.
 -spec format_error(any()) -> iolist().
 format_error({missing_package, Name, undefined}) ->
-    io_lib:format("Package not found in any repo: ~ts.", [rebar_utils:to_binary(Name)]);
+    io_lib:format("Package not found in any repo: ~ts", [rebar_utils:to_binary(Name)]);
 format_error({missing_package, Name, Vsn}) ->
-    io_lib:format("Package not found in any repo: ~ts-~ts.", [rebar_utils:to_binary(Name),
-                                                              rebar_utils:to_binary(Vsn)]);
+    io_lib:format("Package not found in any repo: ~ts ~ts", [rebar_utils:to_binary(Name),
+                                                             rebar_utils:to_binary(Vsn)]);
 format_error({parse_dep, Dep}) ->
     io_lib:format("Failed parsing dep ~p", [Dep]);
 format_error({invalid_vsn, Dep, InvalidVsn}) ->
@@ -284,6 +287,32 @@ format_error(Error) ->
 %% Internal functions
 %% ===================================================================
 
+maybe_warn_retired(_, _, _, false) ->
+    ok;
+maybe_warn_retired(_, _, Hash, _) when is_binary(Hash) ->
+    %% don't warn if this is a lock
+    ok;
+maybe_warn_retired(Name, Vsn, _, R=#{reason := Reason}) ->
+    Message = maps:get(message, R, ""),
+    ?WARN("Warning: package ~s-~s is retired: (~s) ~s",
+          [Name, ec_semver:format(Vsn), retire_reason(Reason), Message]);
+maybe_warn_retired(_, _, _, _) ->
+    ok.
+
+%% TODO: move to hex_core
+retire_reason('RETIRED_OTHER') ->
+    "other";
+retire_reason('RETIRED_INVALID') ->
+    "invalid";
+retire_reason('RETIRED_SECURITY') ->
+    "security";
+retire_reason('RETIRED_DEPRECATED') ->
+    "deprecated";
+retire_reason('RETIRED_RENAMED') ->
+    "renamed";
+retire_reason(_Other) ->
+    "other".
+
 %% @private checks that all the beam files have been properly
 %% created.
 -spec has_all_beams(file:filename_all(), [module()]) ->
diff --git a/src/rebar_packages.erl b/src/rebar_packages.erl
index 8a3ffea..7533a44 100644
--- a/src/rebar_packages.erl
+++ b/src/rebar_packages.erl
@@ -24,10 +24,10 @@
 -type package() :: pkg_name() | {pkg_name(), vsn()}.
 
 format_error({missing_package, Name, Vsn}) ->
-    io_lib:format("Package not found in any repo: ~ts-~ts.", [rebar_utils:to_binary(Name),
-                                                              rebar_utils:to_binary(Vsn)]);
+    io_lib:format("Package not found in any repo: ~ts ~ts", [rebar_utils:to_binary(Name),
+                                                             rebar_utils:to_binary(Vsn)]);
 format_error({missing_package, Pkg}) ->
-    io_lib:format("Package not found in any repo: ~p.", [Pkg]).
+    io_lib:format("Package not found in any repo: ~p", [Pkg]).
 
 -spec get(rebar_hex_repos:repo(), binary()) -> {ok, map()} | {error, term()}.
 get(Config, Name) ->
@@ -55,29 +55,25 @@ get_all_names(State) ->
                                                       _='_'}, 
                                              [], ['$1']}])).
 
--spec get_package_versions(unicode:unicode_binary(), unicode:unicode_binary(), ets:tid(), rebar_state:t())
-                          -> [vsn()].
+-spec get_package_versions(unicode:unicode_binary(), unicode:unicode_binary(),
+                           ets:tid(), rebar_state:t()) -> [vsn()].
 get_package_versions(Dep, Repo, Table, State) ->
     ?MODULE:verify_table(State),
-    ets:select(Table, [{#package{key={Dep,'$1', Repo},
-                                 _='_'}, 
-                        [], ['$1']}]).
-
-
-get_package(Dep, Vsn, Hash, Repo, Table, State) ->
-    get_package(Dep, Vsn, Hash, false, [Repo], Table, State).
+    AllowPreRelease = rebar_state:get(State, deps_allow_prerelease, false),
+    ets:select(Table, [{#package{key={Dep,{'$1', '$2'}, Repo},
+                                 _='_'},
+                        [{'==', '$2', {{[],[]}}} || not AllowPreRelease], [{{'$1', '$2'}}]}]).
 
 -spec get_package(unicode:unicode_binary(), unicode:unicode_binary(),
-                  binary() | undefined | '_', boolean() | '_',
-                  unicode:unicode_binary() | '_' | list(), ets:tab(), rebar_state:t())
+                  binary() | undefined | '_',
+                  [unicode:unicode_binary()] | ['_'], ets:tab(), rebar_state:t())
                  -> {ok, #package{}} | not_found.
-get_package(Dep, Vsn, undefined, Retired, Repo, Table, State) ->
-    get_package(Dep, Vsn, '_', Retired, Repo, Table, State);
-get_package(Dep, Vsn, Hash, Retired, Repos, Table, State) ->
+get_package(Dep, Vsn, undefined, Repos, Table, State) ->
+    get_package(Dep, Vsn, '_', Repos, Table, State);
+get_package(Dep, Vsn, Hash, Repos, Table, State) ->
     ?MODULE:verify_table(State),
-    case ets:select(Table, [{#package{key={Dep, Vsn, Repo},
+    case ets:select(Table, [{#package{key={Dep, ec_semver:parse(Vsn), Repo},
                                       checksum=Hash,
-                                      retired=Retired,
                                       _='_'}, [], ['$_']} || Repo <- Repos]) of
         %% have to allow multiple matches in the list for cases that Repo is `_`
         [Package | _] ->
@@ -258,7 +254,7 @@ update_package(Name, RepoConfig=#{name := Repo}, State) ->
 
 insert_releases(Name, Releases, Repo, Table) ->
     [true = ets:insert(Table,
-                       #package{key={Name, Version, Repo},
+                       #package{key={Name, ec_semver:parse(Version), Repo},
                                 checksum=parse_checksum(Checksum),
                                 retired=maps:get(retired, Release, false),
                                 dependencies=parse_deps(Dependencies)})
@@ -279,7 +275,7 @@ resolve_version(Dep, DepVsn, Hash, HexRegistry, State) when is_binary(Hash) ->
     RepoNames = [RepoName || #{name := RepoName} <- RepoConfigs],
 
     %% allow retired packages when we have a checksum
-    case get_package(Dep, DepVsn, Hash, '_', RepoNames, HexRegistry, State) of
+    case get_package(Dep, DepVsn, Hash, RepoNames, HexRegistry, State) of
         {ok, Package=#package{key={_, _, RepoName}}} ->
             {ok, RepoConfig} = rebar_hex_repos:get_repo_config(RepoName, RepoConfigs),
             {ok, Package, RepoConfig};
@@ -289,7 +285,7 @@ resolve_version(Dep, DepVsn, Hash, HexRegistry, State) when is_binary(Hash) ->
                           none ->
                               not_found;
                           {ok, Vsn} ->
-                              get_package(Dep, Vsn, Hash, Repo, HexRegistry, State)
+                              get_package(Dep, Vsn, Hash, [Repo], HexRegistry, State)
                       end
                   end,
             handle_missing_no_exception(Fun, Dep, State)
@@ -300,7 +296,7 @@ resolve_version(Dep, undefined, Hash, HexRegistry, State) ->
                   none ->
                       not_found;
                   {ok, Vsn} ->
-                      get_package(Dep, Vsn, Hash, Repo, HexRegistry, State)
+                      get_package(Dep, Vsn, Hash, [Repo], HexRegistry, State)
               end
           end,
     handle_missing_no_exception(Fun, Dep, State);
@@ -314,7 +310,7 @@ resolve_version(Dep, DepVsn, Hash, HexRegistry, State) ->
                           none ->
                               not_found;
                           {ok, Vsn} ->
-                              get_package(Dep, Vsn, Hash, Repo, HexRegistry, State)
+                              get_package(Dep, Vsn, Hash, [Repo], HexRegistry, State)
                       end
                   end,
             handle_missing_no_exception(Fun, Dep, State)