bin/58355: pkg_add -f <package> doesn't install packages with missing dependencies

[pmcphee%givex.com@localhost]

>Number:         58355
>Category:       bin
>Synopsis:       pkg_add -f <package> doesn't install packages with missing dependencies
>Confidential:   no
>Severity:       non-critical
>Priority:       medium
>Responsible:    bin-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Thu Jun 20 16:15:00 +0000 2024
>Originator:     Patrick TJ McPhee
>Release:        9.3, 10.0
>Organization:
Givex Canada Corporation
>Environment:
NetBSD  10.0 NetBSD 10.0 (GENERIC) #0: Thu Mar 28 08:33:33 UTC 2024  mkrepro%mkrepro.NetBSD.org@localhost:/usr/src/sys/arch/amd64/compile/GENERIC amd64

>Description:
>From man pkg_add:

     -f      Force installation to proceed even if prerequisite packages are
             not installed or the install script fails.

In my use case, I have a system with a copy of /usr/pkg from a build machine, but which doesn't include /var/db/pkg. If I try to install a package with a dependency, pkg_add will fail to install it:

# pkg_add -fU py311-msgpack-1.0.7nb1.tgz                                                 
pkg_add: no pkg found for 'python311>=3.11.0', sorry.
pkg_add: Can't install dependency python311>=3.11.0, continuing
pkg_add: Missing dependency python311>=3.11.0 ignored
pkg_add: Expected dependency python311>=3.11.0 still missing
pkg_add: 1 package addition failed

The problem appears to have been introduced in revisions 1.7:1.8 of src/external/bsd/pkg_install/dist/add/perform.c. Previously, we had this:

			best_installed = find_best_matching_installed_pkg(p->name);
			if (best_installed == NULL && ForceDepends) {
				warnx("Missing dependency %s ignored", p->name);
				continue;
			} else if (best_installed == NULL) {

however the ForceDepends check was removed during some refactoring. Now we have:

		best_installed = find_best_matching_installed_pkg(p->name, 0);
		if (best_installed == NULL) {
			warnx("Expected dependency %s still missing", p->name);
			return -1;
		}

>How-To-Repeat:
Build a system with at least one package which can be a dependency for others. e.g., python. Build another system with a copy of the /usr/pkg from that build system, but without /var/db/pkg. Build a depending package (e.g., any python package) on the build machine. Copy the binary package to the copy machine and install with

pkg_add -fU <pkgname>

>Fix:
Something like

		best_installed = find_best_matching_installed_pkg(p->name, 0);
		if (best_installed == NULL && ForceDepends) {
			warnx("Missing dependency %s ignored", p->name);
			continue;
		}
		else if (best_installed == NULL) {
			warnx("Expected dependency %s still missing", p->name);
			return -1;
		}