[Rd] R check false positive - multiple versions of a dependency

[Dénes Tóth]

----
Disclaimer: I sent this report first to r-package-devel using r-project.org 
but it seems it has not been delivered to the list - re-trying to r-devel
----

Dear R maintainers,

Use case:
Restrict the acceptable versions of an imported package (e.g., 'pkg') to 
a closed interval. That is, provide *both* pkg (>= min.version.nr), pkg 
(<= max.version.nr) under Imports.

Problem:
Even though the package is an internal package, I want to have clean R 
CMD check results for QC reasons, and this seems impossible due to a bug 
in tools/R/QC.R/.check_package_description2.

Details:
This is a quote from Writing R Extensions, 1.1.3 Package Dependencies:

"A package or ‘R’ can appear more than once in the ‘Depends’ field, for 
example to give upper and lower bounds on acceptable versions."

In reality, this statement seems untrue: 1) only R can appear more than 
once (even base packages like 'stats' trigger a NOTE in R CMD check); 2) 
Not only 'Depends', but other fields (Imports, Suggests, Enhances) can 
contain duplicated entries in the sense that the entries are processed 
as expected, but the check gives a NOTE.

Minimal reproducible example:
In a (Linux) terminal, issue the following commands (note the Depends row):

#####
mkdir -p pkgname
echo "
Depends: R (>= 3.1.0), R (<= 4.1.0)
Package: pkgname
Version: 0.5-1
Date: 2021-04-15
Title: My First Collection of Functions
Author: Joe Developer [aut, cre],
   Pat Developer [aut],
   A. User [ctb]
Maintainer: Joe Developer <Joe.Developer using some.domain.net>
Description: A (one paragraph) description of what
   the package does and why it may be useful.
License: GPL (>= 2)
" > pkgname/DESCRIPTION

R CMD build pkgname
_R_CHECK_CRAN_INCOMING_REMOTE_=FALSE R CMD check pkgname_0.5-1.tar.gz 
--as-cran --no-manual
#####

The commands above return with "Status: OK" - so far so good.

Now instead of restricting the R version, let us restrict the version of 
'stats'. (This is the only change, see Depends.)

#####
echo "
Depends: stats (>= 0.0.0), stats (<= 10.0.0)
Package: pkgname
Version: 0.5-1
Date: 2021-04-15
Title: My First Collection of Functions
Author: Joe Developer [aut, cre],
   Pat Developer [aut],
   A. User [ctb]
Maintainer: Joe Developer <Joe.Developer using some.domain.net>
Suggests: MASS
Description: A (one paragraph) description of what
   the package does and why it may be useful.
License: GPL (>= 2)
" > pkgname/DESCRIPTION
R CMD build pkgname
_R_CHECK_CRAN_INCOMING_REMOTE_=FALSE R CMD check pkgname_0.5-1.tar.gz 
--as-cran --no-manual
#####

Now the status is "Status: 1 NOTE", and the note is:
"Package listed in more than one of Depends, Imports, Suggests, Enhances:
   ‘stats’
A package should be listed in only one of these fields."

Possible fix:
1) I think the highlighted sentence in Writing R Extensions should read as:
"A package or ‘R’ can appear more than once in the ‘Depends’ field, for 
example to give upper and lower bounds on acceptable versions. For 
packages, the same rule applies for ‘Imports’ and ‘Suggests’ fields (see 
later)."

2) In .check_package_description2(), 
'unique(allpkgs[duplicated(allpkgs)])' shall be replaced with a more 
elaborated check. BTW, that check appears twice in the function, where 
the first result is assigned to 'out' and is never used until 'out' gets 
re-assigned. See 
https://github.com/r-devel/r-svn/blob/0d65935f30dcaccfeee1dd61991bf4b1444873bc/src/library/tools/R/QC.R#L3553

If you agree this is a bug, I can create a formal bug report and 
probably create a patch, too.

Regards,
Denes