pkg/44814: security/py-crypto contains (indirect probably) dependency inconsistency

[kre%munnari.OZ.AU@localhost]

>Number:         44814
>Category:       pkg
>Synopsis:       security/py-crypto
>Confidential:   no
>Severity:       non-critical
>Priority:       medium
>Responsible:    pkg-manager
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sat Apr 02 04:35:00 +0000 2011
>Originator:     Robert Elz
>Release:        NetBSD 5.0   (pkgsrc current (HEAD) 2011-04-01)
>Organization:
        Prince of Songkla University
>Environment:
System: NetBSD jade.coe.psu.ac.th 5.1 NetBSD 5.1 (JADE-1.12-20101117) #5: Wed 
Nov 17 05:30:55 ICT 2010 
kre%jade.coe.psu.ac.th@localhost:/usr/obj/5.1/kernels/i386/JADE i386
Architecture: i386
Machine: i386
>Description:
        First, even though this is a PR on security/py-crypto
        I have a suspicion (unsubstantiated at the minute, I have
        not had time to check) that this is another instance of
        a general pkgsrc problem (I think this might be similar
        to the problem reported in PR pkg/36264 which was closed
        when the problem vanished when one of the two involved
        packages was removed).

        That is, if there are two (conflicting) packages that can
        provide what a third package needs, and the third package
        lists alternative dependencies, then we get problems when a
        fourth package appears that requires the third, and
        exactly one of the first two (a particular one, with the
        other not being equivalent).

        If the build of #3 happens to pick the one (or #1 and #2)
        that #4 is going to (later) require, then all is well,
        and no-one even notices the problem.  If the other is
        chosen by the build of #3, then #4 cannot build, as it
        cannot install its dependencies - the only solution is
        to remove #3, and rebuild it differently.  That's not nice.

        I am not certain that is what is happening here, but that,
        or something similar to it, might be the underlying source
        of this build failure.

        In this case, the build of security/py-crypto fails, because
        py26-amkCrypto-2.0.1nb4 has already been installed.

        Since I start with an empty sandbox (certainly no python
        related packages installed) py26-amkCrypto-2.0.1nb4 must
        have been installed as a dependency of something that
        security/py-crypto requires (directly or indirectly).

        As I assume that someone was able to build security/py-crypto
        I conclude that there must be a path that allows the
        dependency to be installed without py26-amkCrypto-2.0.1nb4
        and hence my conclusion that there are probably alternative
        dependencies somewhere here as well (as there were in PR 36264)

>How-To-Repeat:
        I use pkg_comp with NetBSD 5.0 release sets installed, and
        libkver.   The crucial factor here is that I build one package
        (to a binary package) at a time, and then destroy the
        sandbox and start again for the next package, so all packages
        installed as dependencies some from pre-build binary packages
        (with whatever dependencies they had compiled into them).

        In that environment, I see ...

=> Unwrapping files-to-be-installed.
INFO: [subst.mk:unwrap] Nothing changed in ./Doc/epydoc-config.
===> Installing for py26-crypto-2.3
ERROR: py26-crypto-2.3 conflicts with installed package(s):
ERROR:     py26-amkCrypto-2.0.1nb4
ERROR: They install the same files into the same place.
ERROR: Please remove conflicts first with pkg_delete(1).
*** Error code 1

Stop.
make: stopped in /usr/pkgsrc/security/py-crypto

        When this happens, the packages installed are ...

Dependencies installed ...
libkver-1.0         Shared library and sysctl(1) replacement to override system 
version
digest-20080510     Message digest wrapper utility
pkg_install-20110215 Package management and administration tools for pkgsrc
checkperms-1.11     Check and correct file permissions
osabi-NetBSD-5.0    Operating System version dummy-package
x11-links-0.65      Shadow tree of links to native X11 headers and libraries
perl-5.12.2nb1      Practical Extraction and Report Language
lintpkgsrc-4.82     Sanity checks on the complete pkgsrc tree
libffi-3.0.9        Foreign function interface
python26-2.6.6nb7   Interpreted, interactive, object-oriented programming 
language
py26-setuptools-0.6c11nb1 New Python packaging system
py26-amkCrypto-2.0.1nb4 Cryptographic and hash functions for Python
py26-paramiko-1.7.6 SSH2 protocol library
gmp-5.0.1           Library for arbitrary precision arithmetic

        The ones from libkver down to (including) lintpkgsrc-4.82
        are my "empty" sandbox.  The rest are the dependencies
        installed for security/py-crypto

>Fix:
        For the immediate problem, just removing the alternative
        dependency spec (allowing only one) would fix it - assuming
        my guess of the cause of the problem is correct.

        For the general problem, no idea, it is not easy.