[question] Conan centre package rereleases about conan HOT 7 OPEN

Hi @KingKiller100

Thanks for your question.

Quick question, have you read https://docs.conan.io/2/devops/using_conancenter.html? This would be updated advice on how to use ConanCenter packages in production environments.

from conan.

Regarding your questions:

What are the reasons for allowing libraries to rerelease recipes an previously released version instead of forcing them to make new unique releases?

Because often it is necessary to do changes to recipes, that still package exactly the same source code, for example the boost - 1.81.0 source code. When the recipe changes to accomodate some new compiler, architecture, or to solve a bug, it gets a new revision, yet the underlying packaged source code is boost/1.81.0. Conan cannot invent a new version different from the boost original version, that would be super confusing, so it generates a recipe revision instead.

What are the ways we as users are meant to get around the issues I have detailed here? For example, is appending the recipe hash the correct solution, or could copying the built recipe from conan centre to the company's artifactory with a unique user/channel be a better one?

The advice in https://docs.conan.io/2/devops/using_conancenter.html for your case:

• Do not use a different user/channel for ConanCenter
• Build your own binaries from source, from conan-center-index repo (in Conan 2 the new "local-recipes-index" feature can help with this: https://blog.conan.io/2024/04/23/Introducing-local-recipes-index-remote.html)

from conan.

Hi @memsharded, thanks for the swift reply. It is very much appreciated.

No, I have not seen those links before. Thank you for adding them here so I can reach them easily. I'll read over them and use the information to help my issue.

I noticed these links and your response mentions how Conan 2 is expected to work for production envs. Would the information in your response and these links extend to Conan 1.x series too (sadly not ready to upgrade to 2.0 yet)?

from conan.

I noticed these links and your response mentions how Conan 2 is expected to work for production envs. Would the information in your response and these links extend to Conan 1.x series too (sadly not ready to upgrade to 2.0 yet)?

Yes, most of the information in that docs is equally valid for Conan 1.X with a couple of notes:

• Creating and using lockfiles in Conan 1.X is far more complex than in Conan 2, where lockfiles have been greatly simplified and improved
• So the recommendation to create your own binaries from conan-center-index repo (or a fork) is probably even more recommended in Conan 1.X
• The local-recipes-index feature doesn't exist in Conan 1.X, but it is possible to achieve very similar results with some simple scripts.

from conan.

@memsharded I think this is systemic of packaging not being contained with official sources like other ecosystems do, I personally believe Conan should take note from Debian, where rereleases use ~dsfg.* as post releases/repacks, and I don't think anyone finds it too confusing

from conan.