Prevent auto-unlocked path repo packages from also unlocking their transitive deps when -w/-W is used

[Seldaek]

Refs #10093

As @stof said:

@Seldaek maybe this forced inclusion of path packages should be done after building the whitelist with -w/-W, so that the path packages don't automatically whitelist their dependencies when this option are used (they would still whitelist their dependencies if the path packages are explicitly marked for update in the whitelist in the command)

[stof]

is there a way to test this ?

[Seldaek]

You mean to write tests for it? It's kinda a pain as it requires a path repo which we don't support well in the .test files. Could write a specific test for it though with some backing fixtures it should be doable.

[Seldaek]

OK now with test 👍🏻

[naderman]

To add a second more meaningful test more meaningful can you actually make the package in the path repo have requirements which change from one version to the next and what effect it has when that requirement changes but the requirement is locked?

[Seldaek]

@naderman I modified the test to have more specific constraints and vary the constraints between locked and fresh path repo packages.

The mirrored/transitive2 gets fully unlocked including 1.0.0 which I think is correct as mirrored/path-pkg in locked version requires 1.* and when it gets unlocked we load the locked package still?

symlinked/transitive2 however gets only 1.0.1+ unlocked via the root/update requirement which is >=1.0.1.

The */transitive packages do not get unlocked as they are only referenced by path repo packages which now do not unlock transitive deps anymore.

[naderman]

@Seldaek This helps. I was hoping for a second test which tests how this fails. So when a path repo changes its require constraints but because the transitive deps aren't updated its dependencies cannot be met and the thing errors.

[Seldaek]

@naderman the last commit adds a full installer test with pretty much the same inputs as the poolbuilder test, which already fails because the new transitive requirements are for 2.x and the locked ones are 1.x, it just wasn't shown as failing in poolbuilder because that doesn't run the solver. I hope this is what you meant.

[Seldaek]

Rebased this on top of #10280, fixed some more bugs relating to my implementation here, and fixed the test ("symlinked/path-pkg-replace": "*" was still missing in the root requires for that package to be loaded at all), and now it looks good I believe.

[Seldaek]

The diff is a mess tho with the two PRs so let's focus on merging #10280 first :)

[Seldaek]

OK the diff is back to a reviewable state. Most of the changes are actually to fix a bug in removeLoadedPackage when removing packages which were not locked. The rest is fairly minimal changes.

[naderman]

It's not clear to me why this shouldn't unlock alias packages if a remove is necessary?

[Seldaek]

Actually it's not clear to me why unlockPackage was ever called in removeLoadedPackage - as it's only ever called from unlockPackage, it makes no sense. The aliases have the same name as the aliased package, and unlockPackage works only based on the name, so unlocking the same name again is useless. Removed this entirely in the last commit.

[naderman]

Tests look correct to me and seem to work. In general fine with this now, just the small notes I left you could still address.