Installing specific package versions from Private Posit PPM instance

[jjjermiah]

at our organization, we host an internal instance of PPM licensed through Posit, and we are looking to use pak as our default package manager

We currently point via options(repos=)
CRAN -> https://packagemanager.posit.co/cran/__linux__/jammy/latest
INTERNAL -> https://internal.pkgs.site.com/cran/__linux__/jammy/latest

For the most part this all works fine, except when trying to support specific package versions via:

pak::pkg_install('ourpkg@1.6.0') when the latest is at 1.6.4

in this case pak installs 1.6.4 despite asking for 1.6.0. The only way I've gotten this to work is with the full URL pointing to the archived tar.

However this works fine for any package from the CRAN (PPM) repo.

I tested naming our internal repo CRAN via options, and then it works perfectly, I'm assuming theres something that disregards other package repos?

I understand this might be a niche issue, and I'm more than happy to contribute to address it.

Thank you!

Some trouble shooting info:
our PPM version: Basic v2025.09.2-10

pak::pak_sitrep()

> pak::pak_sitrep()
* pak version:
- 0.9.1
* Version information:
- pak platform: x86_64-pc-linux-gnu (current: x86_64-pc-linux-gnu, compatible)
- pak repository: - (local install?)
* Optional packages installed:
- pillar
* Library path:
- /usr/local/lib/R/site-library
- /usr/local/lib/R/library
- /usr/lib/R/site-library
- /usr/lib/R/library
* pak is installed at /usr/local/lib/R/site-library/pak.
* Dependency versions:
- callr      3.7.6     
- cli        3.6.5     
- curl       5.2.3     
- desc       1.4.3     
- filelock   1.0.3     
- jsonlite   2.0.0     
- keyring    1.4.0.9000
- lpSolve    5.6.23    
- pkgbuild   1.4.8     
- pkgcache   2.2.4.9000
- pkgdepends 0.9.0.9000
- pkgsearch  3.1.5     
- processx   3.8.6     
- ps         1.9.1     
- R6         2.5.1     
- yaml       2.3.10    
- zip        2.3.3     
* Dependencies can be loaded

[kenahoo]

I'm seeing this problem too, with our internal repository. In our case, it's not a PPM repository, it's a different flavor of "CRAN-like" repository.

In my case, I can't change the name to CRAN, because our packages also have dependencies on actual public CRAN packages as well as other packages in our internal repository.

What would you suggest to enforce these versioned dependencies properly and get them installed?