Repository: conan-io/conan

Issue:
conan install failing with stacktrace
### What is your question?

conan 2.0.16

I have a lockfile created with `--lockfile-packages`. Inhere I have a dependency on libcurl: 
```
        [
            "libcurl/8.4.0#c0e7f02841de4c02cf4f52a54328ebaf%1705889426.739",
            {
                "e2b8ce0092c007a3b9528a956da3a687ad4bfb5a": "e87a5c3e1453c022b01e87f5bb01b540"
            }
        ],
```
The package has been build and is in my remote, but not in my local cache.
Then I call install to get the dependencies installed. 
```
conan install --lockfile-packages --lockfile=Build/Locks/x86_64-pc-linux-gnu.lock --profile:build Build/Profiles/x86_64-pc-linux-gnu --profile:host Build/Profiles/x86_64-pc-linux-gnu -s:h build_type=Release -s:h &:build_type=Release --update conanfile.py
```
When calculating what to download from my remote I see this in my graph root:
```
boost/1.72.0#31df8f6cf801bd2ad49f3f37b161d770 - Cache (conan-virtual)
libcurl/8.4.0#c0e7f02841de4c02cf4f52a54328ebaf - Cache (conan-virtual)
openssl/1.1.1q#cec037cbac52f0c1be52ae8577bd84d0 - Cache (conan-virtual)
``` 
which looks fine. The rrev matches!
Later in the output I see:
```
boost/1.72.0#31df8f6cf801bd2ad49f3f37b161d770:2d0b05800c60a849f908be56adf0271307ce8180#e97361f05636c84310f39576d0ed1a82 - Cache
libcurl/8.4.0#c0e7f02841de4c02cf4f52a54328ebaf:e2b8ce0092c007a3b9528a956da3a687ad4bfb5a#e87a5c3e1453c022b01e87f5bb01b540 - None
openssl/1.1.1q#cec037cbac52f0c1be52ae8577bd84d0:c6d8d2e89cc76cb0a85f21a53647da7b117beff6#514468b2b707d4e7dd632a4037323bed - Cache
```
The rrev, package id and prev matches what I have built and uploaded. But it has "None" at the end of the line?
It then finishes with a trace:
```
ERROR: Traceback (most recent call last):
File "/lib/python3.10/site-packages/conan/cli/cli.py", line 270, in main
cli.run(args)
File "/lib/python3.10/site-packages/conan/cli/cli.py", line 180, in run
command.run(self._conan_api, args[0][1:])
File "/lib/python3.10/site-packages/conan/cli/command.py", line 126, in run
info = self._method(conan_api, parser, *args)
File "/lib/python3.10/site-packages/conan/cli/commands/install.py", line 73, in install
conan_api.install.install_binaries(deps_graph=deps_graph, remotes=remotes)
File "/lib/python3.10/site-packages/conan/api/subapi/install.py", line 21, in install_binaries
installer.install(deps_graph, remotes)
File "/lib/python3.10/site-packages/conans/client/installer.py", line 258, in install
self._handle_package(package, install_reference, handled_count, package_count)
File "/lib/python3.10/site-packages/conans/client/installer.py", line 304, in _handle_package
assert package.binary in (BINARY_CACHE, BINARY_BUILD, BINARY_DOWNLOAD, BINARY_UPDATE)
AssertionError
```

Any clue about what's going on?

Regards


### Have you read the CONTRIBUTING guide?

- [X] I've read the CONTRIBUTING guide


Discussion:
Hi @klausholstjacobsen 

The ``--lockfile-packages`` is an "undocumented" feature, and not available for production. It will likely be removed soon.
It appears only in the embedded ``conan xxx -h`` help, but it is not documented in the relevant usage sections of lockfiles in the docs:
- https://docs.conan.io/2/tutorial/consuming_packages/intro_to_versioning.html
- https://docs.conan.io/2/tutorial/versioning/lockfiles.html
And there is no intention to document it at the moment.

It seems that we should try to hide it from the ``argparse`` that generates the ``-h`` or at least put some clarification on code for that automatically generated help.

The reason is that locking packages shouldn't be really necessary ever. Locking the recipe-revisions, that identify all the "source" origins, including the versions and the hashes of the input source code should be more than enough to achieve full reproducibility. Note that:
- locking the ``package-ids`` is unnecessary, they are a function of the source + profile inputs.
- Having more than 1 package-revision is considered in Conan 2.0 a model or process error. No ``package-id`` should have more than 1 package-revision, and while Conan will resolve to latest package-revision, it will not take it into account for example to compute new package-ids of the consumers.

I will do a PR to hide the argument from the CLI help



Patch:
diff --git a/conan/cli/args.py b/conan/cli/args.py
index 2a1767c7346..39b99740e45 100644
--- a/conan/cli/args.py
+++ b/conan/cli/args.py
@@ -31,7 +31,7 @@ def add_lockfile_args(parser):
     parser.add_argument("--lockfile-out", action=OnceArgument,
                         help="Filename of the updated lockfile")
     parser.add_argument("--lockfile-packages", action="store_true",
-                        help="Lock package-id and package-revision information")
+                        help=argparse.SUPPRESS)
     parser.add_argument("--lockfile-clean", action="store_true",
                         help="Remove unused entries from the lockfile")
     parser.add_argument("--lockfile-overrides",
diff --git a/conan/cli/command.py b/conan/cli/command.py
index a924dda9b74..474e94639c4 100644
--- a/conan/cli/command.py
+++ b/conan/cli/command.py
@@ -107,6 +107,8 @@ def __init__(self, conan_api, *args, **kwargs):
     def parse_args(self, args=None, namespace=None):
         args = super().parse_args(args)
         ConanOutput.define_log_level(os.getenv("CONAN_LOG_LEVEL", args.v))
+        if getattr(args, "lockfile_packages", None):
+            ConanOutput().error("The --lockfile-packages arg is private and shouldn't be used")
         if args.core_conf:
             from conans.model.conf import ConfDefinition
             confs = ConfDefinition()


Test patch:
diff --git a/conans/test/integration/lockfile/test_lock_packages.py b/conans/test/integration/lockfile/test_lock_packages.py
index 6e86449ff1c..ae3f613dc40 100644
--- a/conans/test/integration/lockfile/test_lock_packages.py
+++ b/conans/test/integration/lockfile/test_lock_packages.py
@@ -22,6 +22,7 @@ def test_lock_packages(requires):
     prev = client.created_package_revision("pkg/0.1")
 
     client.run("lock create consumer/conanfile.txt --lockfile-packages")
+    assert "ERROR: The --lockfile-packages arg is private and shouldn't be used" in client.out
     assert "pkg/0.1#" in client.out
     lock = client.load("consumer/conan.lock")
     assert NO_SETTINGS_PACKAGE_ID in lock