For whatever reason php didn't upgrade automatically from 5.1.6-r6 to 5.2.1-r3 on a amd64 system. I could notice this by pure luck because "glsa-check -d affected" told me that my version of php was insecure and I had to upgrade. So then I run 'emerge -uDNva world" and it told me there was nothing to upgrade. So I run 'emerge -u php' and that one told me it was going to upgrade php. here the log that confirms it: 1176468690: Started emerge on: Apr 13, 2007 14:51:30 1176468690: *** emerge --newuse --deep --ask --update --verbose world 1176468704: *** terminating. 1176468712: Started emerge on: Apr 13, 2007 14:51:52 1176468712: *** emerge --oneshot --update php 1176468713: >>> emerge (1 of 1) dev-lang/php-5.2.1-r3 to / 1176468713: === (1 of 1) Cleaning (dev-lang/php-5.2.1-r3::/usr/portage/dev-lang/php/php-5.2.1-r3.ebuild) 1176468714: === (1 of 1) Compiling/Merging (dev-lang/php-5.2.1-r3::/usr/portage/dev-lang/php/php-5.2.1-r3.ebuild) 1176468783: Started emerge on: Apr 13, 2007 14:53:03 php isn't in the world file, 'equery d php' returns this: [ Searching for packages depending on php... ] dev-lang/swig-1.3.31 (php? virtual/php) net-print/cups-1.2.9 (php? dev-lang/php) www-misc/zoneminder-1.22.3 (virtual/httpd-php) this is the --info Portage 2.1.2.2 (default-linux/amd64/2006.1/desktop, gcc-4.1.1, glibc-2.5-r0, 2.6.20-gentoo-r3 x86_64) ================================================================= System uname: 2.6.20-gentoo-r3 x86_64 AMD Athlon(tm) 64 X2 Dual Core Processor 4600+ Gentoo Base System release 1.12.9 Timestamp of tree: Thu, 12 Apr 2007 01:46:01 +0000 distcc 2.18.3 x86_64-pc-linux-gnu (protocols 1 and 2) (default port 3632) [disabled] ccache version 2.4 [enabled] dev-java/java-config: 1.3.7, 2.0.31-r5 dev-lang/python: 2.4.3-r4 dev-python/pycrypto: 2.0.1-r5 dev-util/ccache: 2.4-r6 sys-apps/sandbox: 1.2.17 sys-devel/autoconf: 2.13, 2.61 sys-devel/automake: 1.4_p6, 1.5, 1.6.3, 1.7.9-r1, 1.8.5-r3, 1.9.6-r2, 1.10 sys-devel/binutils: 2.16.1-r3 sys-devel/gcc-config: 1.3.15-r1 sys-devel/libtool: 1.5.22 virtual/os-headers: 2.6.17-r2 ACCEPT_KEYWORDS="amd64" AUTOCLEAN="yes" CBUILD="x86_64-pc-linux-gnu" CFLAGS="-O2 -pipe -march=athlon64" CHOST="x86_64-pc-linux-gnu" CONFIG_PROTECT="/etc /usr/kde/3.5/env /usr/kde/3.5/share/config /usr/kde/3.5/shutdown /usr/share/X11/xkb /usr/share/config /var/bind" CONFIG_PROTECT_MASK="/etc/env.d /etc/env.d/java/ /etc/gconf /etc/java-config/vms/ /etc/php/apache1-php5/ext-active/ /etc/php/apache2-php5/ext-active/ /etc/php/cgi-php5/ext-active/ /etc/php/cli-php5/ext-active/ /etc/revdep-rebuild /etc/terminfo /etc/texmf/web2c" CXXFLAGS="-O2 -pipe -march=athlon64" DISTDIR="/usr/portage/distfiles" FEATURES="ccache distlocks metadata-transfer parallel-fetch sandbox sfperms strict" GENTOO_MIRRORS="ftp://ftp.unina.it/pub/linux/distributions/gentoo" LINGUAS="en it" MAKEOPTS="-j3" PKGDIR="/usr/portage/packages" PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress --force --whole-file --delete --delete-after --stats --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages --filter=H_**/files/digest-*" PORTAGE_TMPDIR="/var/tmp" PORTDIR="/usr/portage" PORTDIR_OVERLAY="/usr/local/portage /usr/portage/local/layman/armagetron" SYNC="" USE="X a52 aac acpi alsa amd64 apache2 ares arts asf berkdb bitmap-fonts bluetooth bzip2 cairo caps ccache cdparanoia cdr cli cracklib crypt cups dbus dovecot-sasl dri dts dv dvb dvd dvdr dvdread eds emacs emboss encode esd examples fam ffmpeg filter firefox flac gdbm geoip gif gmp gnome gpgme gpm gs gstreamer gtk gtk2 hal hardened iconv ieee1394 ilbc imap ipod iproute2 ipv6 irda isdnlog ivtv jack-tmpfs java jpeg jpeg2k kde lcd ldap libg++ libsamplerate lirc logrotate mad mbox midi mikmod mozilla mp3 mpeg mysql ncurses nls nntp nptl nptlonly nsplugin ogg opengl oss pam pcre pdf perl physfs png pop postgres ppds pppd python qt3 qt4 quicktime readline reflection samba sasl sdl session smime snmp speex spell spl sqlite ssl svg tcpd tetex theora tiff tordns truetype truetype-fonts type1-fonts unicode urandom usb v4l v4l2 visualization vorbis vorbis-psy x264 xcomposite xinetd xml xorg xv xvid xvmc zlib" ALSA_CARDS="ali5451 als4000 atiixp atiixp-modem bt87x ca0106 cmipci emu10k1x ens1370 ens1371 es1938 es1968 fm801 hda-intel intel8x0 intel8x0m maestro3 trident usb-audio via82xx via82xx-modem ymfpci" ALSA_PCM_PLUGINS="adpcm alaw asym copy dmix dshare dsnoop empty extplug file hooks iec958 ioplug ladspa lfloat linear meter mulaw multi null plug rate route share shm softvol" ELIBC="glibc" INPUT_DEVICES="keyboard mouse evdev" KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LINGUAS="en it" LIRC_DEVICES="mceusb2" USERLAND="GNU" VIDEO_CARDS="nvidia nv" Unset: CTARGET, EMERGE_DEFAULT_OPTS, INSTALL_MASK, LANG, LC_ALL, LDFLAGS, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS I can try to reproduce it by downgrading php if you want. I just wonder if you ever seen anything like that. Reproducible: Didn't try
(In reply to comment #0) > [ Searching for packages depending on php... ] > dev-lang/swig-1.3.31 (php? virtual/php) > net-print/cups-1.2.9 (php? dev-lang/php) > www-misc/zoneminder-1.22.3 (virtual/httpd-php) You don't have php in your global USE flags, so the first 2 might not matter since they are only triggered if USE=php is enabled. Do you have zoneminder listed in your world file? Make sure that dev-lang/php is not in /var/lib/portage/world and then create a depclean debug log and attach it: emerge --pretend --depclean --debug >& debug.log
thanks for the quick help. www-misc/zoneminder is in the world file yes.
Created attachment 116186 [details] emerge --pretend --depclean --debug btw, emerge -p --depclean shows nothing to unmerge.
virtual/httpd-php is only a build time dependency (DEPEND) of zoneminder, so the default behavior is to only pull it into the dependency graph when zoneminder is going to be built. If you want unnecessary build time dependencies to be pulled into the dependency graph, use emerge's --with-bdeps=y option (see `man emerge`). *** This bug has been marked as a duplicate of bug 150238 ***
Thanks for the explanation of why it wasn't updated. So I'm going to stick with --with-bdeps=y . I think as default leaving insecure packages isn't a good idea, and if you really don't want to make --with-bdeps=y the default, I suggest to at least remove them during --depclean for security reasons. Leaving old stuff installed and runnable is just a perfect way to be eventually exploited ;) BTW, zoneminder is mistaken if it thinks php is only needed at build time, infact I'd be surprised if php is ever needed during build and install, it's likely only needed at runtime. Thanks! (let's keep the followups on the other bug)
(In reply to comment #5) > BTW, zoneminder is mistaken if it thinks php is only needed at build time, > infact I'd be surprised if php is ever needed during build and install, it's > likely only needed at runtime. Please file a nice fresh bug for that and assign it to web-apps@gentoo.org.
