{"action":"opened","issue":{"url":"https://api.github.com/repos/nim-lang/nimble/issues/164","labels_url":"https://api.github.com/repos/nim-lang/nimble/issues/164/labels{/name}","comments_url":"https://api.github.com/repos/nim-lang/nimble/issues/164/comments","events_url":"https://api.github.com/repos/nim-lang/nimble/issues/164/events","html_url":"https://github.com/nim-lang/nimble/issues/164","id":116069603,"number":164,"title":"Prevent use of global packages","user":{"login":"andreaferretti","id":1962818,"avatar_url":"https://avatars.githubusercontent.com/u/1962818?v=3","gravatar_id":"","url":"https://api.github.com/users/andreaferretti","html_url":"https://github.com/andreaferretti","followers_url":"https://api.github.com/users/andreaferretti/followers","following_url":"https://api.github.com/users/andreaferretti/following{/other_user}","gists_url":"https://api.github.com/users/andreaferretti/gists{/gist_id}","starred_url":"https://api.github.com/users/andreaferretti/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/andreaferretti/subscriptions","organizations_url":"https://api.github.com/users/andreaferretti/orgs","repos_url":"https://api.github.com/users/andreaferretti/repos","events_url":"https://api.github.com/users/andreaferretti/events{/privacy}","received_events_url":"https://api.github.com/users/andreaferretti/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-11-10T09:32:58Z","updated_at":"2015-11-10T09:32:58Z","closed_at":null,"body":"Right now, nimble allows to list dependencies, and retrieves them (if needed) at build time.\r\n\r\nThis is a step towards reproducible builds, but unfortunately comes with a caveat. If package `foo` is already installed - maybe as a dependency of another project - it will be available at build time even if it is not listed among the project dependencies.\r\n\r\nThis opens the following scenario:\r\n\r\n* user 1 has project A that depends on package `foo`\r\n* when building A, `foo` gets installed\r\n* user 1 also has project B, that **should** depend on `foo`, but forgets to add it to the list of dependencies in the nimble file\r\n* when building B, the previously installed `foo` is used, and user 1 thinks everything is alright, so commits to a repository\r\n* user 2 clones the repository, and tries to build project B, but fails because of the missing dependency `foo`.\r\n\r\nTo avoid this, `nimble x` commands should only use packages explicitly listed as dependencies (and their transitive dependencies). If this is not possible, maybe there could be a flag enabling this behaviour."}}