.gitignore, config, nimble: use lock file

[ee7]

Before this commit, configlet pinned the version of each Nimble dependency by using the .nimble file. This was the best approach until recently, and was good enough for creating configlet releases, but it wasn't robust - Nimble wasn't designed to produce reproducible builds with that mechanism. For example, Nimble didn't check the hash of a package at build time to ensure that it was unmodified.

Now that we've updated to Nim 2.0 and vendored the parseopt3 dependency, let's use Nimble's new lock file mechanism. This should be robust.

Run nimble lock and nimble setup, and remove versions from the nimble file.

From the docs for nimble lock:

The nimble lock command will generate or update a package lock file named nimble.lock. This file is used for pinning the exact versions of the dependencies of the package. The file is intended to be committed and used by other developers to ensure that exactly the same version of the dependencies is used by all developers.

[...]

If a lock file nimble.lock`` exists, then on performing all Nimble commands which require searching for dependencies and downloading them in the case they are missing (like build, install, develop`), it is read and its content is used to download the same version of the project dependencies by using the URL, download method and VCS revision written in it. The checksum of the downloaded package is compared against the one written in the lock file. In the case the two checksums are not equal then it will be printed error message and the operation will be aborted. Reverse dependencies are added for installed locked dependencies just like for any other package being locally installed.

and the docs for nimble setup:

The nimble setup command creates a nimble.paths file containing file system paths to the dependencies. It also includes the paths file in the config.nims file (by creating it if it does not already exist) to make them available for the compiler. nimble.paths file is user-specific and MUST NOT be committed. The command also adds nimble.develop and nimble.paths files to the .gitignore file.`

Closes: #467

---

To-do:

• Wait for a Nim release that adds support for the Nimble that supports lock files.
• Either wait for Nim to ship with a Nimble that supports lock files, or manually install such a Nimble version in our CI workflows. Edit: Nim 2.0.0 should ship with a Nimble that supports lock files.
• Bump package versions
• Merge .github, config, json, nimble: bump Nim from 1.6.12 to 2.0.0 #723
• Resolve problem with importing nimble packages when lock file present, when not using nimble build.
• Consider if there's a better place to run nimble setup

Refs: d6d7283
Closes: #467

[ee7]

Unfortunately, the Nim 1.6.0 release doesn't include a Nimble version with the nimble lock functionality. A few issues were found, and the version of the bundled Nimble version was rolled back (see nim-lang/Nim@3d7c52f).

We could (maybe pretty easily) update the Nimble version that we use in the GitHub Actions environment, so that we have the nimble lock functionality there. But I won't do that immediately - this PR can sit a little longer, even though we merged #419.

[ee7]

This looks promising: nim-lang/Nim@908fc2a

[ee7]

This looks promising: nim-lang/Nim@908fc2a

Nim 1.6.2 RC1 is now out, which is intended to support the Nimble that can use lockfiles. But it doesn't ship with it. See:

• https://forum.nim-lang.org/t/8710
• https://forum.nim-lang.org/t/8712

[ee7]

Nim 2.0 should ship with a nimble version that supports lock files.

[ee7]

With f3cfca9, nimble build works, but nimble test doesn't. I feel like it should.

[ee7]

The error here is unexpected to me. I'm not sure what I'm supposed to do.

To ask, I've opened nim-lang/Nim#22438.

[ee7]

Only 23 months for this one.

Please see:

• https://github.com/nim-lang/nimble#nimble-lock
• https://github.com/nim-lang/nimble#nimble-setup
• nim-lang/nimble#1004