pkg/48713: pkgin update does not update changes in local (file://) repository, while pkgin -f update does

[vs%nifelheim.info@localhost]

>Number:         48713
>Category:       pkg
>Synopsis:       pkgin update does not update changes in local (file://) 
>repository, while pkgin -f update does
>Confidential:   no
>Severity:       non-critical
>Priority:       medium
>Responsible:    pkg-manager
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sat Apr 05 15:20:00 +0000 2014
>Originator:     Volkmar Seifert
>Release:        NetBSD 6.1
>Organization:
>Environment:
NetBSD panther.home.nifelheim.info 6.1_STABLE NetBSD 6.1_STABLE (PANTHER-1.0) 
#0: Mon Mar 24 12:07:37 CET 2014  
mjoellnir@cheetah:/work/netbsd/v6/work/amd64/panther/obj/work/netbsd/v6/src/sys/arch/amd64/compile/PANTHER
 amd64
>Description:
Changes to the local repository (like adding a package through pkg_comp build 
some/package), "pkgin update" does not update its database.
A pkg_summary-file is present and updated in the local repository.
When I run "pkgin -f update" however, all packages (even the newly added) are 
inserted into pkgin's database.
>How-To-Repeat:
1.) Create a local packages-repository, e.g. like when setting up pkg_comp
2.) add this repo to pkgin's repositories
3.) update pkgin
4.) add a package to repository, e.g. with pkg_comp build some/pkg
5.) run "pkgin update"

The new package won't be there.
>Fix:
As it's already known that pkgin uses the pkg_summary-file's mtime, this 
somehow doesn't seem to be enough to detect changes.
My suggestion is to switch from a date/time check to creating and checking a 
checksum, e.g. RMD160 or SHA1 - or maybe both for the paranoid.