{"action":"created","issue":{"url":"https://api.github.com/repos/conda/conda/issues/1882","repository_url":"https://api.github.com/repos/conda/conda","labels_url":"https://api.github.com/repos/conda/conda/issues/1882/labels{/name}","comments_url":"https://api.github.com/repos/conda/conda/issues/1882/comments","events_url":"https://api.github.com/repos/conda/conda/issues/1882/events","html_url":"https://github.com/conda/conda/issues/1882","id":120020385,"number":1882,"title":"Conda packages should contain authoritative dependency information","user":{"login":"ijstokes","id":293525,"avatar_url":"https://avatars.githubusercontent.com/u/293525?v=3","gravatar_id":"","url":"https://api.github.com/users/ijstokes","html_url":"https://github.com/ijstokes","followers_url":"https://api.github.com/users/ijstokes/followers","following_url":"https://api.github.com/users/ijstokes/following{/other_user}","gists_url":"https://api.github.com/users/ijstokes/gists{/gist_id}","starred_url":"https://api.github.com/users/ijstokes/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ijstokes/subscriptions","organizations_url":"https://api.github.com/users/ijstokes/orgs","repos_url":"https://api.github.com/users/ijstokes/repos","events_url":"https://api.github.com/users/ijstokes/events{/privacy}","received_events_url":"https://api.github.com/users/ijstokes/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-12-02T19:43:11Z","updated_at":"2016-02-05T06:23:10Z","closed_at":null,"body":"A package's `meta.yaml` or its equivalent should be embedded into every package.  I should be able to look at a package tarball and find out *exactly* what its dependencies are.  Right now that isn't the case.  In fact the situation is (I would argue) worse than that because it *appears* that the dependencies are embedded, but what is in there is not, in fact, the \"real\" details of the package dependency.  I still don't understand what the `requires` and `info.json` files contain, but I'm told that the definitive dependencies live elsewhere in a `repodata.json` file that is managed on the package server but not (easily? at all?) available to the conda user who has fetched the package.\r\n\r\nA concrete discussion of this can be found here with lots of examples:\r\n\r\nhttps://github.com/ContinuumIO/anaconda-issues/issues/563"},"comment":{"url":"https://api.github.com/repos/conda/conda/issues/comments/180218284","html_url":"https://github.com/conda/conda/issues/1882#issuecomment-180218284","issue_url":"https://api.github.com/repos/conda/conda/issues/1882","id":180218284,"user":{"login":"ilanschnell","id":334496,"avatar_url":"https://avatars.githubusercontent.com/u/334496?v=3","gravatar_id":"","url":"https://api.github.com/users/ilanschnell","html_url":"https://github.com/ilanschnell","followers_url":"https://api.github.com/users/ilanschnell/followers","following_url":"https://api.github.com/users/ilanschnell/following{/other_user}","gists_url":"https://api.github.com/users/ilanschnell/gists{/gist_id}","starred_url":"https://api.github.com/users/ilanschnell/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ilanschnell/subscriptions","organizations_url":"https://api.github.com/users/ilanschnell/orgs","repos_url":"https://api.github.com/users/ilanschnell/repos","events_url":"https://api.github.com/users/ilanschnell/events{/privacy}","received_events_url":"https://api.github.com/users/ilanschnell/received_events","type":"User","site_admin":false},"created_at":"2016-02-05T06:23:10Z","updated_at":"2016-02-05T06:23:10Z","body":"As mentioned earlier, `repodata.json` is the definite source of truth, as far as conda is concerned.  I'm not sure this is still confusing."}}