Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 545656 - repoman: warn when USE dependencies lock dependency on older version
Summary: repoman: warn when USE dependencies lock dependency on older version
Status: RESOLVED WONTFIX
Alias: None
Product: Portage Development
Classification: Unclassified
Component: Repoman (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Portage team
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2015-04-05 21:53 UTC by Michał Górny
Modified: 2022-07-12 03:18 UTC (History)
0 users

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Michał Górny archtester Gentoo Infrastructure gentoo-dev Security 2015-04-05 21:53:16 UTC
As discussed in [1], the idea is to make repoman complain when the USE constraints in a dependency string can't be satisfied with the newest version that would match the dependency without USE constraints.

In other words, if we have:

  foo-1 with USE=bar
  foo-2 without USE=bar
  bar-1 depending on foo[bar(-)]

Repoman should complain (when scanning bar-1) that 'foo[bar(-)]' dependency can't be satisfied by foo-2, and will force the package to be locked at foo-1.

Right now, Portage only silently locks the dependency for users. As a result, the package is outdated for a long time and at some point all hell breaks loose. Having the warning in place, we will have the opportunity to find such issues earlier and solve them.

The developers will be either required to fix/update the dependency string to work with foo-2, or to use explicit "<foo-2" dependency that is clear in the restrictions it is enforcing and easier to grep for.

[1]:https://archives.gentoo.org/gentoo-dev/message/ed97f631d84b748bc3e426c5302b6261
Comment 1 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2022-07-12 03:18:27 UTC
repoman support has been removed per bug 835013.

Please file a new bug (or, I suppose, reopen this one) if you feel this check is still applicable to pkgcheck and doesn't already exist.