Use a lockfile to persist Pub's installed version constellation.

utils/tests/pub/pub_test.dart

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #library('pub_tests');
 
 #import('dart:io');
 
 #import('test_pub.dart');
 #import('../../../lib/unittest/unittest.dart');
@@ skipping 235 matching lines @@
     ]).scheduleValidate();
 
     dir(packagesPath, [
       dir('foo', [
         file('foo.dart', 'main() => "foo";')
       ])
     ]).scheduleValidate();
 
     // TODO(nweiz): remove this once we support pub update
     dir(packagesPath).scheduleDelete();
+    file('$appPath/pubspec.lock', '').scheduleDelete();
 
     git('foo.git', [
       file('foo.dart', 'main() => "foo 2";')
     ]).scheduleCommit();
 
     schedulePub(args: ['install'],
         output: const RegExp(@"Dependencies installed!$"));
 
     // When we download a new version of the git package, we should re-use the
     // git/cache directory but create a new git/ directory.
@@ skipping 308 matching lines @@
         file('bar.dart', 'main() => print("bar 2.3.4");')
       ]),
       dir('baz', [
         file('pubspec.yaml', '{name: baz, version: 2.0.4}'),
         file('baz.dart', 'main() => print("baz 2.0.4");')
       ])
     ]).scheduleValidate();
 
     run();
   });
+
+  test('keeps a Git package locked to the version in the lockfile', () {
+    ensureGit();
+
+    git('foo.git', [
+      file('foo.dart', 'main() => "foo";')
+    ]).scheduleCreate();
+
+    dir(appPath, [
+      file('pubspec.yaml', '''
+dependencies:
+  foo:
+    git: ../foo.git
+''')
+    ]).scheduleCreate();
+
+    // This install should lock the foo.git dependency to the current revision.
+    schedulePub(args: ['install'],
+        output: const RegExp(@"Dependencies installed!$"));
+
+    dir(packagesPath, [
+      dir('foo', [
+        file('foo.dart', 'main() => "foo";')
+      ])
+    ]).scheduleValidate();
+
+    // Delete the packages path to simulate a new checkout of the application.
+    dir(packagesPath).scheduleDelete();
+
+    git('foo.git', [
+      file('foo.dart', 'main() => "foo 2";')
+    ]).scheduleCommit();
+
+    // This install shouldn't update the foo.git dependency due to the lockfile.
+    schedulePub(args: ['install'],
+        output: const RegExp(@"Dependencies installed!$"));
+
+    dir(packagesPath, [
+      dir('foo', [
+        file('foo.dart', 'main() => "foo";')
+      ])
+    ]).scheduleValidate();
+
+    run();
+  });
+
+  test('updates a locked Git package with a new incompatible constraint', () {
+    ensureGit();
+
+    git('foo.git', [
+      file('foo.dart', 'main() => "foo";')
+    ]).scheduleCreate();
+
+    dir(appPath, [
+      file('pubspec.yaml', '''
+dependencies:
+  foo:
+    git: ../foo.git
+''')
+    ]).scheduleCreate();
+
+    schedulePub(args: ['install'],
+        output: const RegExp(@"Dependencies installed!$"));
+
+    dir(packagesPath, [
+      dir('foo', [
+        file('foo.dart', 'main() => "foo";')
+      ])
+    ]).scheduleValidate();
+
+    git('foo.git', [
+      file('foo.dart', 'main() => "foo 1.0.0";'),
+      file('pubspec.yaml', 'version: 1.0.0')
+    ]).scheduleCommit();
+
+    dir(appPath, [
+      file('pubspec.yaml', '''
+dependencies:
+  foo:
+    git: ../foo.git
+    version: ">=1.0.0"
+''')
+    ]).scheduleCreate();
+
+    schedulePub(args: ['install'],
+        output: const RegExp(@"Dependencies installed!$"));
+
+    dir(packagesPath, [
+      dir('foo', [
+        file('foo.dart', 'main() => "foo 1.0.0";')
+      ])
+    ]).scheduleValidate();
+
+    run();
+  });
+
+  test("doesn't update a locked Git package with a new compatible "
+      "constraint", () {
+    ensureGit();
+
+    git('foo.git', [
+      file('foo.dart', 'main() => "foo 1.0.0";'),
+      file('pubspec.yaml', 'version: 1.0.0')
+    ]).scheduleCreate();
+
+    dir(appPath, [
+      file('pubspec.yaml', '''
+dependencies:
+  foo:
+    git: ../foo.git
+''')
+    ]).scheduleCreate();
+
+    schedulePub(args: ['install'],
+        output: const RegExp(@"Dependencies installed!$"));
+
+    dir(packagesPath, [
+      dir('foo', [
+        file('foo.dart', 'main() => "foo 1.0.0";')
+      ])
+    ]).scheduleValidate();
+
+    git('foo.git', [
+      file('foo.dart', 'main() => "foo 1.0.1";'),
+      file('pubspec.yaml', 'version: 1.0.1')
+    ]).scheduleCommit();
+
+    dir(appPath, [
+      file('pubspec.yaml', '''
+dependencies:
+  foo:
+    git: ../foo.git
+    version: ">=1.0.0"
+''')
+    ]).scheduleCreate();
+
+    schedulePub(args: ['install'],
+        output: const RegExp(@"Dependencies installed!$"));
+
+    dir(packagesPath, [
+      dir('foo', [
+        file('foo.dart', 'main() => "foo 1.0.0";')
+      ])
+    ]).scheduleValidate();
+
+    run();
+  });
+
+  test('keeps a pub server package locked to the version in the lockfile', () {
+    var serverFuture =
+      servePackages("localhost", 3123, ['{name: foo, version: 1.0.0}']);
+
+    dir(appPath, [
+      file('pubspec.yaml', '''
+dependencies:
+  foo:
+    repo: {name: foo, url: http://localhost:3123}
+''')
+    ]).scheduleCreate();
+
+    // This install should lock the foo dependency to version 1.0.0.
+    schedulePub(args: ['install'],
+        output: const RegExp(@"Dependencies installed!$"));
+
+    dir(packagesPath, [
+      dir('foo', [
+        file('foo.dart', 'main() => print("foo 1.0.0");')
+      ])
+    ]).scheduleValidate();
+
+    // Delete the packages path to simulate a new checkout of the application.
+    dir(packagesPath).scheduleDelete();
+
+    // Start serving a newer package as well.
+    servePackages("localhost", 3123, [
+      '{name: foo, version: 1.0.0}',
+      '{name: foo, version: 1.0.1}'
+    ]);
+
+    // This install shouldn't update the foo dependency due to the lockfile.
+    schedulePub(args: ['install'],
+        output: const RegExp(@"Dependencies installed!$"));
+
+    dir(packagesPath, [
+      dir('foo', [
+        file('foo.dart', 'main() => print("foo 1.0.0");')
+      ])
+    ]).scheduleValidate();
+
+    run();
+  });
+
+  test('updates a locked pub server package with a new incompatible '
+      'constraint', () {
+    var serverFuture =
+      servePackages("localhost", 3123, ['{name: foo, version: 1.0.0}']);
+
+    dir(appPath, [
+      file('pubspec.yaml', '''
+dependencies:
+  foo:
+    repo: {name: foo, url: http://localhost:3123}
+''')
+    ]).scheduleCreate();
+
+    schedulePub(args: ['install'],
+        output: const RegExp(@"Dependencies installed!$"));
+
+    dir(packagesPath, [
+      dir('foo', [
+        file('foo.dart', 'main() => print("foo 1.0.0");')
+      ])
+    ]).scheduleValidate();
+
+    servePackages("localhost", 3123, [
+      '{name: foo, version: 1.0.0}',
+      '{name: foo, version: 1.0.1}'
+    ]);
+
+    dir(appPath, [
+      file('pubspec.yaml', '''
+dependencies:
+  foo:
+    repo: {name: foo, url: http://localhost:3123}
+    version: ">1.0.0"
+''')
+    ]).scheduleCreate();
+
+    schedulePub(args: ['install'],
+        output: const RegExp(@"Dependencies installed!$"));
+
+    dir(packagesPath, [
+      dir('foo', [
+        file('foo.dart', 'main() => print("foo 1.0.1");')
+      ])
+    ]).scheduleValidate();
+
+    run();
+  });
+
+  test("doesn't update a locked pub server package with a new compatible "
+      "constraint", () {
+    var serverFuture =
+      servePackages("localhost", 3123, ['{name: foo, version: 1.0.0}']);
+
+    dir(appPath, [
+      file('pubspec.yaml', '''
+dependencies:
+  foo:
+    repo: {name: foo, url: http://localhost:3123}
+''')
+    ]).scheduleCreate();
+
+    schedulePub(args: ['install'],
+        output: const RegExp(@"Dependencies installed!$"));
+
+    dir(packagesPath, [
+      dir('foo', [
+        file('foo.dart', 'main() => print("foo 1.0.0");')
+      ])
+    ]).scheduleValidate();
+
+    servePackages("localhost", 3123, [
+      '{name: foo, version: 1.0.0}',
+      '{name: foo, version: 1.0.1}'
+    ]);
+
+    dir(appPath, [
+      file('pubspec.yaml', '''
+dependencies:
+  foo:
+    repo: {name: foo, url: http://localhost:3123}
+    version: ">=1.0.0"
+''')
+    ]).scheduleCreate();
+
+    schedulePub(args: ['install'],
+        output: const RegExp(@"Dependencies installed!$"));
+
+    dir(packagesPath, [
+      dir('foo', [
+        file('foo.dart', 'main() => print("foo 1.0.0");')
+      ])
+    ]).scheduleValidate();
+
+    run();
+  });
 }
 
 versionCommand() {
   test('displays the current version', () =>
     runPub(args: ['version'], output: VERSION_STRING));
 }