Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

proj lock generates invalid URLs with exclude-newer for source packages that P3M lists with a `Path:`

Open
  • Is something wrong?
#484 0 comments 1 reaction 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
66/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Active
Tech stack
rust
Domain
backend

Research direction

Start by locating the rig proj lock code that builds source package URLs from the P3M PACKAGES index, then trace how it handles the Path: field when exclude-newer selects a snapshot. Compare the generated URL with the working example in the issue and run the relevant lock or sync tests. Done means source URLs include the indexed subdirectory when needed and the reported sync no longer gets a 404.

Written by the indexing model from the issue text.

Description

bug

Hi, and thanks for rig and rig proj, which I have been enjoying a lot!

I noticed that a lock file can generate illegal URLS when exclude-newer for source packages that have in the P3M index entry a Path: field. I think rig writes a source URL without that path, which 404s.

rig version: 0.11.0 (macOS, arm64)

Minimal example

rproj.toml:

[project]
name = "bug"
version = "0.1.0"
type = "project"

[dependencies]
R = ">= 4.6"
Rcpp = "*"

[tool.rig]
exclude-newer = "2026-01-14"

$ rig proj lock
$ rig proj sync
...
✗ Failed to download https://p3m.dev/cran/2026-01-08/src/contrib/Rcpp_1.1.0.8.2.tar.gz, status: 404 Not Found
✗ All download URLs failed.

What I found

The PACKAGES index of that snapshot lists the package with a Path: field:

Package: Rcpp
Version: 1.1.0.8.2
Path: 4.6.0/Other
Depends: R (>= 4.6)

The file is not in src/contrib/ but in the subdirectory named by Path::

$ curl -sI -o /dev/null -w "%{http_code}\n" https://p3m.dev/cran/2026-01-08/src/contrib/Rcpp_1.1.0.8.2.tar.gz
404
$ curl -sI -o /dev/null -w "%{http_code}\n" https://p3m.dev/cran/2026-01-08/src/contrib/4.6.0/Other/Rcpp_1.1.0.8.2.tar.gz
200

Potential confounding factor

When I remove the exclude-newer line from rproj.toml, then the lock file is all well and I can successfully sync it. Yet, the URLs are also without the extra Path: 4.6.0/Other. Nevertheless, those URLS do now exist in the package manager.

$ cat rproj.lock
...
[[targets.packages]]
package = "Rcpp"
version = "1.1.2"
binary = false
platform = "source"
dependencies = []
sources = ["https://p3m.dev/cran/2026-07-06/src/contrib/Rcpp_1.1.2.tar.gz"]
target = "src/Rcpp_1.1.2-0af8c486.tar.gz"
groups = ["main"]
metadata = { RemoteHash = "2746cf2fb188e5f0a84dbf5c8f68915b54564ed33e5754572f174e7b32e7f4f3" }
...
Dominant language
Rust
Stars
1k
Forks
39
Avg merge
18h 5m
Merged PRs (30d)
25

Getting set up

  • Ships a Dockerfile or Docker Compose file
  • No pull request template
  • No contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from r-lib/rig

All issues in r-lib/rig

Similar issues

More Rust issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.