Debian Bug report logs - #774873
Circular dependency in java-headless packages

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Iain Lane <laney@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: Dependencies are not always configured before the depending package, since 9ee62ec

Date: Thu, 08 Jan 2015 15:15:43 +0000

[Message part 1 (text/plain, inline)]

Package: dpkg
Version: 1.17.23
Severity: serious

Hello,

[ Reported as RC because it could make packages fail to install
  correctly, but I don't have an instance in Debian handy, so feel free
  to downgrade ]

Since commit 9ee62ecfc8937f24a82805a424564997042dd984 ("Make the initial
dependtry be 1 instead of 0"), dpkg will in some circumstances configure
the dependencies of a package *after* configuring the package itself.

I noticed this in Ubuntu where we have a package "floodlight" which has
Depends on default-jre-headless and tries to use /usr/bin/java, which is
set up in the postinst of openjdk-7-jre-headless using alternatives.
openjdk-7-jre-headless is being configured after floodlight, meaning
that this fails. Here's the log

  https://jenkins.qa.ubuntu.com/job/vivid-adt-floodlight/15/ARCH=amd64,label=adt/console

You should see "start/started" after floodlight is configured, not
"start/pre-start". The error reveals itself in the log files on the
system.

Attached is an equivs control file that you can use to reproduce this on
Debian. It's not minimal, but was enough for me to be able to bisect it
down to the commit identified. A way to reproduce is like this (ignore
vivid, that's the name of the host):

(sid-amd64)root@vivid:/# dpkg --version
Debian `dpkg' package management program version 1.17.23 (amd64).
[…]
(sid-amd64)root@vivid:/# apt-cache show foo
[…]
Depends: default-jre-headless | java6-runtime-headless
(sid-amd64)root@vivid:/# apt-cache show default-jre-headless
[…]
Depends: openjdk-7-jre-headless (>= 7~u3-2.1.1), […]
[…]
(sid-amd64)root@vivid:/# apt-get install --no-install-recommends foo
[…]
Setting up foo (1.0) ...
Setting up openjdk-7-jre-headless:amd64 (7u71-2.5.3-2) ...

(-headless is configured after foo which transitively depends on it)

And you can reproduce like this, once you've got the dependencies
installed

(sid-amd64)root@vivid:/# dpkg --unpack --auto-deconfigure /var/cache/apt/archives/default-jre-headless_2%3a1.7-52_amd64.deb /var/cache/apt/archives/ca-certificates-java_20140324_all.deb /var/cache/apt/archives/openjdk-7-jre-headless_7u71-2.5.3-2_amd64.deb /var/cache/apt/archives/foo_1.0_all.deb
[…]
(sid-amd64)root@vivid:/# dpkg --configure openjdk-7-jre-headless:amd64 ca-certificates-java:all default-jre-headless:amd64 foo:all
Setting up default-jre-headless (2:1.7-52) ...
Setting up foo (1.0) ...
Setting up openjdk-7-jre-headless:amd64 (7u71-2.5.3-2) ...
Setting up ca-certificates-java (20140324) ...
[…]

Let me know if you need any more info, like debugging output.

(If a solution isn't immediately apparent, is this commit safe to revert
for the time being?)

Cheers,

-- 
Iain Lane                                  [ iain@orangesquash.org.uk ]
Debian Developer                                   [ laney@debian.org ]
Ubuntu Developer                                   [ laney@ubuntu.com ]

[control (text/plain, attachment)]

Message #10 received at 774873@bugs.debian.org (full text, mbox, reply):

From: Guillem Jover <guillem@debian.org>

To: Iain Lane <laney@debian.org>, 774873@bugs.debian.org

Subject: Re: Bug#774873: Dependencies are not always configured before the depending package, since 9ee62ec

Date: Thu, 8 Jan 2015 17:27:54 +0100

Hi!

On Thu, 2015-01-08 at 15:15:43 +0000, Iain Lane wrote:
> Package: dpkg
> Version: 1.17.23
> Severity: serious

> [ Reported as RC because it could make packages fail to install
>   correctly, but I don't have an instance in Debian handy, so feel free
>   to downgrade ]

I don't think this is a bug at all in dpkg, but see below.

> Since commit 9ee62ecfc8937f24a82805a424564997042dd984 ("Make the initial
> dependtry be 1 instead of 0"), dpkg will in some circumstances configure
> the dependencies of a package *after* configuring the package itself.

The only effect of that commit was that it removed a run stage from
the package processing queue, possibly affecting how packages are
ordered in some cases, which has exposed wrong assumptions (for example
in debootstrap). But any package depending on that specific ordering
was relying on undefined behavior.

> And you can reproduce like this, once you've got the dependencies
> installed

Thanks for the reproducer!

> (sid-amd64)root@vivid:/# dpkg --unpack --auto-deconfigure /var/cache/apt/archives/default-jre-headless_2%3a1.7-52_amd64.deb /var/cache/apt/archives/ca-certificates-java_20140324_all.deb /var/cache/apt/archives/openjdk-7-jre-headless_7u71-2.5.3-2_amd64.deb /var/cache/apt/archives/foo_1.0_all.deb
> […]
> (sid-amd64)root@vivid:/# dpkg --configure openjdk-7-jre-headless:amd64 ca-certificates-java:all default-jre-headless:amd64 foo:all
> Setting up default-jre-headless (2:1.7-52) ...
> Setting up foo (1.0) ...
> Setting up openjdk-7-jre-headless:amd64 (7u71-2.5.3-2) ...
> Setting up ca-certificates-java (20140324) ...
> […]
> 
> Let me know if you need any more info, like debugging output.
> 
> (If a solution isn't immediately apparent, is this commit safe to revert
> for the time being?)

The problem here is that there's a dependency cycle and dpkg breaks it
now in a different place due to the change in the processing queue. But
this has been a latent issue or an actual issue (depending on the
upgrade path) on the java packages. Here's the cycle:

  foo -Depends→ default-jre-headless | java6-runtime-headless
  default-jre-headless -Depends→ openjdk-7-jre-headless
  default-jre-headless -Provides→ java6-runtime-headless
  openjdk-7-jre-headless -Depends→ ca-certificates-java
  openjdk-7-jre-headless -Provides→ java6-runtime-headless
  ca-certificates-java -Depends→
    openjdk-6-jre-headless (>= 6b16-1.6.1-2) | java6-runtime-headless

And dpkg decides to do this (from the debug output), after having made
no progress so far:

,---
[…]
D000400: findbreakcyclerecursive openjdk-6-jre-headless  <- ca-certificates-java
D000400: findbreakcyclerecursive java6-runtime-headless  <- ca-certificates-java
D000400: findbreakcyclerecursive default-jre-headless:amd64  <- ca-certificates-java
D000400: findbreakcyclerecursive openjdk-7-jre-headless:amd64  <- default-jre-headless <- ca-certificates-java
D000040: found cycle
D000040: cycle broken at default-jre-headless:amd64 -> openjdk-7-jre-headless
[…]
D000001: process queue pkg default-jre-headless:amd64 queue.len 3 progress 1, tr
D000400: findbreakcyclerecursive default-jre-headless:amd64
D000400: findbreakcyclerecursive java-common:all  <- default-jre-headless
D000040: checking dependencies of default-jre-headless:amd64 (- <none>)
D000400:   checking group ...
D000400:     checking possibility  -> openjdk-7-jre-headless
D000400:       break cycle so ok and found
D000400:   found 3 matched 0 possfixbytrig -
D000400:   checking group ...
D000400:     checking possibility  -> java-common
D000400:       checking non-provided pkg java-common:all
D000400:       is installed, ok and found
D000400:     found 3
D000400:   found 3 matched 0 possfixbytrig -
D000040: ok 2 msgs >><<
D000040:     checking Breaks
D000400:      checking virtbroken java-runtime-headless
D000400:      checking virtbroken java2-runtime-headless
D000400:      checking virtbroken java5-runtime-headless
D000400:      checking virtbroken java6-runtime-headless
D000400:      checking virtbroken java7-runtime-headless
Setting up default-jre-headless (2:1.7-52) ...
`---

And that's why the Depends order is not preserved. This needs to be
reassigned and fixed somewhere in the Java packages.

Thanks,
Guillem

Message #15 received at 774873@bugs.debian.org (full text, mbox, reply):

From: Iain Lane <laney@debian.org>

To: Guillem Jover <guillem@debian.org>

Cc: 774873@bugs.debian.org

Subject: Re: Bug#774873: Dependencies are not always configured before the depending package, since 9ee62ec

Date: Fri, 9 Jan 2015 11:03:08 +0000

[Message part 1 (text/plain, inline)]

reassign 774873 openjdk-7-jre-headless
retitle 774873 Circular dependency in java-headless packages
thanks

Hey,

On Thu, Jan 08, 2015 at 05:27:54PM +0100, Guillem Jover wrote:
> […]
> The problem here is that there's a dependency cycle and dpkg breaks it
> now in a different place due to the change in the processing queue. But
> this has been a latent issue or an actual issue (depending on the
> upgrade path) on the java packages. Here's the cycle:
> 
>   foo -Depends→ default-jre-headless | java6-runtime-headless
>   default-jre-headless -Depends→ openjdk-7-jre-headless
>   default-jre-headless -Provides→ java6-runtime-headless
>   openjdk-7-jre-headless -Depends→ ca-certificates-java
>   openjdk-7-jre-headless -Provides→ java6-runtime-headless
>   ca-certificates-java -Depends→
>     openjdk-6-jre-headless (>= 6b16-1.6.1-2) | java6-runtime-headless
> […] 
> And that's why the Depends order is not preserved. This needs to be
> reassigned and fixed somewhere in the Java packages.

Oh right, and cycles are, per policy 7.2, allowed to be broken.

  Packages involved in circular dependencies may not be able to rely on
  their dependencies being configured before they themselves are
  configured, depending on which side of the break of the circular
  dependency loop they happen to be on.

I agree that this isn't a dpkg bug. Thanks for your analysis!

Dear Java maintainers, can you please consider how this can be resolved?

Thanks,

-- 
Iain Lane                                  [ iain@orangesquash.org.uk ]
Debian Developer                                   [ laney@debian.org ]
Ubuntu Developer                                   [ laney@ubuntu.com ]

[signature.asc (application/pgp-signature, inline)]

Message #28 received at 774873@bugs.debian.org (full text, mbox, reply):

From: Emmanuel Bourg <ebourg@apache.org>

To: 774873@bugs.debian.org

Cc: Guillem Jover <guillem@debian.org>, Iain Lane <laney@debian.org>

Subject: Re: Bug#774873: Circular dependency in java-headless packages

Date: Thu, 15 Jan 2015 12:11:33 +0100

Could this be solved with a trigger in the ca-certificates-java package?
We change the postinst script [1] to do nothing if the JDK is not
installed (so it's executed on upgrades but not on the first install),
and we add a trigger executing the postinst script when the JDK is
installed. Would that work?

Emmanuel Bourg

[1]
https://sources.debian.net/src/ca-certificates-java/20140324/debian/postinst.in/

Message #33 received at 774873@bugs.debian.org (full text, mbox, reply):

From: Guillem Jover <guillem@debian.org>

To: Emmanuel Bourg <ebourg@apache.org>

Cc: 774873@bugs.debian.org, Iain Lane <laney@debian.org>

Subject: Re: Bug#774873: Circular dependency in java-headless packages

Date: Mon, 19 Jan 2015 11:01:27 +0100

Hi!

On Thu, 2015-01-15 at 12:11:33 +0100, Emmanuel Bourg wrote:
> Could this be solved with a trigger in the ca-certificates-java package?
> We change the postinst script [1] to do nothing if the JDK is not
> installed (so it's executed on upgrades but not on the first install),
> and we add a trigger executing the postinst script when the JDK is
> installed. Would that work?

Assuming that ca-certificates-java is only useful if there's a JRE,
then yeah I guess that would do it. If you go this route, please use
the -noawait trigger variants to not create a trigger cycle.

In any case, and just to clarify. The postinst would have code to
setup the certs and the JAR. This could would be called from configure
only if a JRE is available. And from triggered always.

> [1]
> https://sources.debian.net/src/ca-certificates-java/20140324/debian/postinst.in/

Having taken a look at that script, there's some issues that I've
noticed:

 * Using «dpkg --print-architecture» in maintscripts is almost always
   wrong, in this case what you want is the architecture matching the
   JRE, so you should be doing a dpkg-query on that package instead.
 * dpkg-query has been available for a very long time, just assume
   it's there, no need to which it.
 * The indentation is a bit messed up.

Thanks,
Guillem

Message #38 received at 774873@bugs.debian.org (full text, mbox, reply):

From: Emmanuel Bourg <ebourg@apache.org>

To: Guillem Jover <guillem@debian.org>

Cc: 774873@bugs.debian.org

Subject: Re: Bug#774873: Circular dependency in java-headless packages

Date: Wed, 04 Feb 2015 10:17:16 +0100

Le 19/01/2015 11:01, Guillem Jover a écrit :

> Having taken a look at that script, there's some issues that I've
> noticed:

Thank you for the review Guillem.


>  * Using «dpkg --print-architecture» in maintscripts is almost always
>    wrong, in this case what you want is the architecture matching the
>    JRE, so you should be doing a dpkg-query on that package instead.

You are right, I filed #776860 to address this issue. I installed
openjdk-7-jre:i386 on an amd64 system and for some reason
openjdk-7-jre:amd64 has been pulled as well. I don't know if this is
normal, but at least the ca-certificates-java script was able to run and
create the keystore.


>  * dpkg-query has been available for a very long time, just assume
>    it's there, no need to which it.
>  * The indentation is a bit messed up.

I'll fix that post Jessie.

Emmanuel Bourg

Message #43 received at 774873@bugs.debian.org (full text, mbox, reply):

From: "Rebecca N. Palmer" <rebecca_palmer@zoho.com>

To: 774873@bugs.debian.org

Subject: Re: Circular dependency in java-headless packages

Date: Tue, 17 Mar 2015 14:08:42 +0000

>  I installed
> openjdk-7-jre:i386 on an amd64 system and for some reason
> openjdk-7-jre:amd64 has been pulled as well.

That's probably because of this dependency cycle: multiarch treats 
arch:all packages as the native architecture 
(https://wiki.ubuntu.com/MultiarchSpec#Dependencies_involving_Architecture:_all_packages), 
i.e.

openjdk-7-jre:i386 -> ca-certificates-java:all <-> openjdk-7-jre:amd64

Message #50 received at 774873-done@bugs.debian.org (full text, mbox, reply):

From: Debian FTP Masters <ftpmaster@ftp-master.debian.org>

To: 637250-done@bugs.debian.org,643755-done@bugs.debian.org,661465-done@bugs.debian.org,672279-done@bugs.debian.org,686073-done@bugs.debian.org,690260-done@bugs.debian.org,697658-done@bugs.debian.org,704578-done@bugs.debian.org,705787-done@bugs.debian.org,706200-done@bugs.debian.org,706326-done@bugs.debian.org,711005-done@bugs.debian.org,711180-done@bugs.debian.org,717047-done@bugs.debian.org,717963-done@bugs.debian.org,721063-done@bugs.debian.org,726781-done@bugs.debian.org,726790-done@bugs.debian.org,729513-done@bugs.debian.org,737254-done@bugs.debian.org,742831-done@bugs.debian.org,743481-done@bugs.debian.org,745939-done@bugs.debian.org,750400-done@bugs.debian.org,751290-done@bugs.debian.org,757049-done@bugs.debian.org,761683-done@bugs.debian.org,765484-done@bugs.debian.org,765508-done@bugs.debian.org,766704-done@bugs.debian.org,774873-done@bugs.debian.org,774953-done@bugs.debian.org,775741-done@bugs.debian.org,775976-done@bugs.debian.org,776946-done@bugs.debian.org,777552-done@bugs.debian.org,780665-done@bugs.debian.org,784389-done@bugs.debian.org,785283-done@bugs.debian.org,785452-done@bugs.debian.org,785792-done@bugs.debian.org,788195-done@bugs.debian.org,798214-done@bugs.debian.org,798855-done@bugs.debian.org,799587-done@bugs.debian.org,803235-done@bugs.debian.org,808453-done@bugs.debian.org,813221-done@bugs.debian.org,813790-done@bugs.debian.org,814608-done@bugs.debian.org,820294-done@bugs.debian.org,

Cc: openjdk-7@packages.debian.org, openjdk-7@packages.qa.debian.org

Subject: Bug#820703: Removed package(s) from unstable

Date: Fri, 15 Apr 2016 19:38:07 +0000

Version: 7u95-2.6.4-1+rm

Dear submitter,

as the package openjdk-7 has just been removed from the Debian archive
unstable we hereby close the associated bug reports.  We are sorry
that we couldn't deal with your issue properly.

For details on the removal, please see https://bugs.debian.org/820703

The version of this package that was in Debian prior to this removal
can still be found using http://snapshot.debian.org/.

This message was generated automatically; if you believe that there is
a problem with it please contact the archive administrators by mailing
ftpmaster@ftp-master.debian.org.

Debian distribution maintenance software
pp.
Scott Kitterman (the ftpmaster behind the curtain)

Send a report that this bug log contains spam.