Investigate suspicious looking repos code

[DavisVaughan]

Related to #1963

It looks like this code probably isn't working as intended

renv/R/lockfile.R

Lines 39 to 54 in 8573b0d

	attr(repos, "RStudio") <- NULL
	# check for default repositories
	#
	# note that if the user is using RStudio, we only want to override
	# the repositories if they haven't explicitly set their own repo URL
	#
	# https://github.com/rstudio/renv/issues/1782
	rstudio <- structure(
	list(CRAN = "https://cran.rstudio.com/"),
	RStudio = TRUE
	)
	isdefault <-
	identical(repos, list(CRAN = "@CRAN@")) ||
	identical(repos, rstudio)

In particular, if we clear the attribute with attr(repos, "RStudio") <- NULL then there is no way that repos could ever be identical to rstudio later on.

There is a very similar check elsewhere that does look more correct

renv/R/init.R

Lines 313 to 338 in 91e9553

	renv_init_repos <- function(repos = getOption("repos")) {
	# if PPM is disabled, just use default repositories
	repos <- convert(repos, "list")
	if (!renv_ppm_enabled())
	return(repos)
	# check whether the user has opted into using PPM by default
	enabled <- config$ppm.default()
	if (!enabled)
	return(repos)
	# check for default repositories
	#
	# note that if the user is using RStudio, we only want to override
	# the repositories if they haven't explicitly set their own repo URL
	#
	# https://github.com/rstudio/renv/issues/1782
	rstudio <- structure(
	list(CRAN = "https://cran.rstudio.com/"),
	RStudio = TRUE
	)
	isdefault <-
	identical(repos, list(CRAN = "@CRAN@")) ||
	identical(repos, rstudio)