Re: Proposed fix for long-standing +CONTENTS bug

[Jonathan Perkin <jperkin%joyent.com@localhost>]

* On 2020-04-17 at 19:11 BST, David H. Gutteridge wrote:

> On Fri, 17 Apr 2020 at 11:17:04 -0400, Greg Troxel wrote:
> > Jonathan Perkin <jperkin%joyent.com@localhost> writes:
> > 
> > > I've tried to reproduce this for quite a long time with stress tests
> > > to no avail, but finally today something clicked along with spotting
> > > this error associated with it earlier in the upgrade process:
> > >
> > >   pkg_add: Dependency of p5-Net-SSLeay-1.85nb1 fulfilled by perl-5.28.2, but not by perl-5.30.1
> > 
> > I concur that the problem and this error message are correlated.
> > 
> > Also "pkg_admin rebuild" resolves this, but of course the bug should be fixed.
> > 
> > > It turns out to be caused by dependencies of the form >=X<Y when a
> > > forced upgrade (as used by pkgin, make replace, and no doubt others)
> > > has taken us past Y.  The search for installed packages fails and so
> > > the packages are not removed from +CONTENTS files.  This is why it
> > > appears more often with perl than other packages, as that has enforced
> > > versions, though it has been seen with others.
> > >
> > > My proposed patch is to convert any lookups of specific versions to
> > > just look for -[0-9]* for this code path.  We do not support multiple
> > > packages to be installed with the same PKGBASE, so there should(?) be
> > > no danger here of removing the wrong package:
> > >
> > >   https://github.com/joyent/pkgsrc/issues/256#issuecomment-615243106
> > 
> > That seems ok to me.
> > 
> > > I'm going to be testing this patch for a while (it has passed hundreds
> > > of iterations of my stress test so far) and probably ship it out to my
> > > users for wider testing, but would like it to be integrated at some
> > > point for everyone.
> > 
> > Sounds good - thanks for being the one to finally really track this
> > down.
> 
> In fairness, markd@ shared a related finding back in 2018:
> 
> >I can generalize this to any set of packages that have an upper bound on
> >the required package version that you then use "make replace" to go
> >beyond that version of the required package, then replace the requiring
> >package.   The required package will end up with both the old and new
> >versions of the requiring package in its +REQUIRED_BY file.
> 
> http://mail-index.netbsd.org/tech-pkg/2018/07/18/msg020062.html

Oh interesting, sorry, I think I missed this when it came in.

> I'm hoping this is addressed too?

Yeh it's the same issue.  I of course meant to write +REQUIRED_BY
instead of +CONTENTS in various parts of my original email.

I'm looking at a slightly different fix prompted by Joerg and after
exposing an extra issue with my test suite, I'll post an updated patch
when I have one.  This one should at least work for now though if
people are desperate for a workaround.

Thanks,

-- 
Jonathan Perkin  -  Joyent, Inc.  -  www.joyent.com