pkg/53660: wrong pkg_summary REQUIRES for i386/7.1

[he%NetBSD.org@localhost]

>Number:         53660
>Category:       pkg
>Synopsis:       wrong pkg_summary REQUIRES for i386/7.1
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    pkg-manager
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon Oct 08 08:45:00 +0000 2018
>Originator:     he%NetBSD.org@localhost
>Release:        NetBSD 7.1_STABLE
>Organization:
	I try...
>Environment:
System: NetBSD xxxxx 7.1_STABLE NetBSD 7.1_STABLE (GENERIC) #0: Mon Feb  5 17:43:17 CET 2018  root@xxxxxx:/b/obj/sys/arch/i386/compile/GENERIC i386
Architecture: i386
Machine: i386
>Description:

from time to time I'm updating the packages on some of "my" hosts
which run 7.1_STABLE.  Fairly recently, pkgin has starting giving
error messages about packages which depend on shared libraries
which don't exist on my system:

/usr/lib/libwind.so.1, needed by cmake-3.11.4 is not present in this system.
/usr/lib/libroken.so.20, needed by cmake-3.11.4 is not present in this system.
/usr/lib/libkrb5.so.27, needed by cmake-3.11.4 is not present in this system.
/usr/lib/libhx509.so.6, needed by cmake-3.11.4 is not present in this system.
/usr/lib/libheimntlm.so.5, needed by cmake-3.11.4 is not present in this system.
/usr/lib/libheimbase.so.2, needed by cmake-3.11.4 is not present in this system.
/usr/lib/libgssapi.so.11, needed by cmake-3.11.4 is not present in this system.
/usr/lib/libcom_err.so.8, needed by cmake-3.11.4 is not present in this system.
/usr/lib/libasn1.so.10, needed by cmake-3.11.4 is not present in this system.
/usr/lib/libwind.so.1, needed by curl-7.61.1 is not present in this system.
/usr/lib/libroken.so.20, needed by curl-7.61.1 is not present in this system.
/usr/lib/libkrb5.so.27, needed by curl-7.61.1 is not present in this system.
/usr/lib/libhx509.so.6, needed by curl-7.61.1 is not present in this system.
/usr/lib/libheimntlm.so.5, needed by curl-7.61.1 is not present in this system.
/usr/lib/libheimbase.so.2, needed by curl-7.61.1 is not present in this system.
/usr/lib/libgssapi.so.11, needed by curl-7.61.1 is not present in this system.
/usr/lib/libcom_err.so.8, needed by curl-7.61.1 is not present in this system.
/usr/lib/libasn1.so.10, needed by curl-7.61.1 is not present in this system.

However, doing 'ldd' on e.g. curl, reveals no such problem:

# ldd /usr/pkg/bin/curl
/usr/pkg/bin/curl:
        -lcurl.4 => /usr/pkg/lib/libcurl.so.4
        -lidn2.0 => /usr/pkg/lib/libidn2.so.0
        -lintl.1 => /usr/lib/libintl.so.1
        -lgcc_s.1 => /usr/lib/libgcc_s.so.1
        -lc.12 => /usr/lib/libc.so.12
        -lunistring.2 => /usr/pkg/lib/libunistring.so.2
        -lssl.10 => /usr/lib/libssl.so.10
        -lcrypto.8 => /usr/lib/libcrypto.so.8
        -lcrypt.1 => /usr/lib/libcrypt.so.1
        -lgssapi.10 => /usr/lib/libgssapi.so.10
        -lkrb5.26 => /usr/lib/libkrb5.so.26
        -lhx509.5 => /usr/lib/libhx509.so.5
        -lasn1.9 => /usr/lib/libasn1.so.9
        -lcom_err.7 => /usr/lib/libcom_err.so.7
        -lroken.19 => /usr/lib/libroken.so.19
        -lutil.7 => /usr/lib/libutil.so.7
        -lwind.0 => /usr/lib/libwind.so.0
        -lheimbase.1 => /usr/lib/libheimbase.so.1
        -lheimntlm.4 => /usr/lib/libheimntlm.so.4
        -lz.1 => /usr/lib/libz.so.1
        -lpthread.1 => /usr/lib/libpthread.so.1
#

so this is clearly an instance of the program crying "Wolf, wolf!"
which it should stop doing.

Of course e.g. /usr/lib/libwind.so.1 doesn't exist on this system:

# ls -l /usr/lib/libwind.so*
lrwxr-xr-x  1 root  wheel      14 Mar  8  2017 /usr/lib/libwind.so -> libwind.so.0.0
lrwxr-xr-x  1 root  wheel      14 Mar  8  2017 /usr/lib/libwind.so.0 -> libwind.so.0.0
-r--r--r--  1 root  wheel  163858 Mar  8  2017 /usr/lib/libwind.so.0.0
# 

Looking at pkg_summary.bz2 on ftp.netbsd.org for i386 / 7.1 reveals
that the claimed dependency comes from that file, and in turn that
entry comes from the pkg itself where +BUILD_INFO among other things
says:

PROVIDES=/usr/pkg/lib/libcurl.so
PROVIDES=/usr/pkg/lib/libcurl.so.4
PROVIDES=/usr/pkg/lib/libcurl.so.4.5.0
REQUIRES=/lib/libcrypt.so.1
REQUIRES=/usr/lib/libasn1.so.10
REQUIRES=/usr/lib/libc.so.12
REQUIRES=/usr/lib/libcom_err.so.8
REQUIRES=/usr/lib/libcrypto.so.8
REQUIRES=/usr/lib/libgcc_s.so.1
REQUIRES=/usr/lib/libgssapi.so.11
REQUIRES=/usr/lib/libheimbase.so.2
REQUIRES=/usr/lib/libheimntlm.so.5
REQUIRES=/usr/lib/libhx509.so.6
REQUIRES=/usr/lib/libintl.so.1
REQUIRES=/usr/lib/libkrb5.so.27
REQUIRES=/usr/lib/libpthread.so.1
REQUIRES=/usr/lib/libroken.so.20
REQUIRES=/usr/lib/libsqlite3.so.1
REQUIRES=/usr/lib/libssl.so.10
REQUIRES=/usr/lib/libutil.so.7
REQUIRES=/usr/lib/libwind.so.1
REQUIRES=/usr/lib/libz.so.1
REQUIRES=/usr/pkg/lib/libidn2.so.0
REQUIRES=/usr/pkg/lib/libunistring.so.2

For example, the libwind.so.1 library doesn't exist on 7.1/i386, so
I'm a bit confused as to what caused this entry to appear here.

I must admit that I don't understand how this can happen if the
package was built on a 7.1/i386 system.


>How-To-Repeat:
	Inspect 7.1 i386 pkg_summary file.
	See that several REQUIRES= lines refer to shared library major
	versions which only exist in the 8.0 line of releases.

>Fix:
	Sorry, don't know.