Permanently retire library name on rename or removal

[per1234]

Describe the request

When a library maintainer requests a library name change or the removal of a library from Library Manager, permanently retire that library name so that it can not be reused later by another library.

🙂 This will avoid confusion to Library Manager users caused by ambiguity in dependencies that would otherwise result from there having been two different libraries registered with the same name over time.

🙂 This is essential for reproducible project builds.

Describe the current behavior

The sole unique identifier in Library Manager is the library name. This is used for machine identification of the library:

• arduino-cli lib commands
• depends metadata property
• build profiles

We allow library maintainers to rename or remove their library from Library Manager. In the case of abuse, the Arduino company may also unilaterally remove a library.

Currently, when a library is renamed or removed, the registry entry for the previous name is removed entirely.

🙁 If a different library is later registered under that name, it could cause confusion for users of projects that specify a dependency on the previous library via that name.

🙁 The ability to re-register a library encourages the abuse of removal requests by library maintainers mistakenly thinking this will be an effective way to accomplish some goal, when they should instead either fix the root problem (e.g., an error in the library metadata), or follow a standard procedure (e.g., name change request). For example: arduino/library-registry#1454, arduino/library-registry#4410 (comment).

libraries-repository-engine version

011349f

Additional context

This could be implemented by either using the existing "type" field of the registry:

https://github.com/foo/bar.git|Contributed,Removed|BarLib
https://github.com/baz/qux.git|Contributed,Renamed|Qux Lib
https://github.com/baz/qux.git|Contributed|QuxLib
https://github.com/pippo/pluto.git|Contributed|PlutoLib

Or adding a new field

https://github.com/foo/bar.git|Contributed|BarLib|Removed
https://github.com/baz/qux.git|Contributed|Qux Lib|Renamed
https://github.com/baz/qux.git|Contributed|QuxLib|
https://github.com/pippo/pluto.git|Contributed|PlutoLib|

The sync command of libraries-repository-engine would be configured to skip indexing of the registry entries for libraries marked as renamed or removed.

---

This would also allow rename and removals to be handled automatically by libraries-repository-engine, rather than requiring a manual operation (using the remove command) by the "jenkins/worker maintainer".

---

The implementation of Arduino Lint's rule LP017 ("duplicate name") would need to be changed to use the registry instead of the library index. This is a change that needs to be made regardless (see issue 10138 in the internal Zube tracker), so should not be considered a negative effect of this proposal.

Related

• Reject re-releases of removed release #297

Issue checklist

• I searched for previous requests in the issue tracker
• My request contains all necessary details