Debian Bug report logs - #889470
gem2deb: include upper bound on generated ruby dependencies

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: "Aaron M. Ucko" <ucko@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: dh_ruby: please inject versioned dependency on ruby metapackage

Date: Wed, 19 Apr 2017 13:42:39 -0400

Package: gem2deb
Version: 0.33.1
Severity: normal

Please have compiled Ruby extensions depend on compatible versions of
the ruby metapackage; for instance, an extension built only for 2.3
would depend on ruby (>= 2.3), ruby (<< 2.4), and an extension built
for both 2.3 and 2.4 would depend on ruby (>= 2.3), ruby (<< 2.5).
(Python packaging settled on an analogous approach some time ago.)
Ideally, this dependency would go to a dedicated ${ruby:Depends}
substvar, but adding it to ${misc:Depends} would allow for much faster
adoption.

As it stands, we can get situations like #860512, in which the m68k
build of telegram-desktop failed because ruby 2.3 wound up paired with
a ruby-fast-xs installation that only covered 2.2.  (The 0.8.0-3+b2
m68k binNMU was intended to add 2.3 support, but accidentally picked
up old metapackages.)  With an explicit versioned dependency in place,
generic automated tools would have caught this problem.

Thanks!

-- 
Aaron M. Ucko, KB1CJC (amu at alum.mit.edu, ucko at debian.org)
http://www.mit.edu/~amu/ | http://stuff.mit.edu/cgi/finger/?amu@monk.mit.edu

Message #10 received at 860747-done@bugs.debian.org (full text, mbox, reply):

From: Antonio Terceiro <terceiro@debian.org>

To: "Aaron M. Ucko" <ucko@debian.org>, 860747-done@bugs.debian.org

Subject: Re: Bug#860747: dh_ruby: please inject versioned dependency on ruby metapackage

Date: Wed, 19 Apr 2017 15:50:38 -0300

[Message part 1 (text/plain, inline)]

On Wed, Apr 19, 2017 at 01:42:39PM -0400, Aaron M. Ucko wrote:
> Package: gem2deb
> Version: 0.33.1
> Severity: normal
> 
> Please have compiled Ruby extensions depend on compatible versions of
> the ruby metapackage; for instance, an extension built only for 2.3
> would depend on ruby (>= 2.3), ruby (<< 2.4), and an extension built
> for both 2.3 and 2.4 would depend on ruby (>= 2.3), ruby (<< 2.5).
> (Python packaging settled on an analogous approach some time ago.)
> Ideally, this dependency would go to a dedicated ${ruby:Depends}
> substvar, but adding it to ${misc:Depends} would allow for much faster
> adoption.
> 
> As it stands, we can get situations like #860512, in which the m68k
> build of telegram-desktop failed because ruby 2.3 wound up paired with
> a ruby-fast-xs installation that only covered 2.2.  (The 0.8.0-3+b2
> m68k binNMU was intended to add 2.3 support, but accidentally picked
> up old metapackages.)  With an explicit versioned dependency in place,
> generic automated tools would have caught this problem.

That is already the case:

$ apt-cache show ruby-fast-xs | grep 'Architecture:\|Depends'
Architecture: amd64
Depends: libc6 (>= 2.2.5), libgmp10, libruby2.3 (>= 2.3.0~preview2), ruby (>= 1:2.3~0)


ruby-fast-xs is broken on m68k because it is a very old binary, from before
this was implemented, and AFAICT it can't be built anymore because something
else is not available.

[signature.asc (application/pgp-signature, inline)]

Message #15 received at 860747@bugs.debian.org (full text, mbox, reply):

From: ucko@debian.org (Aaron M. Ucko)

To: Antonio Terceiro <terceiro@debian.org>

Cc: "Aaron M. Ucko" <ucko@debian.org>, <860747@bugs.debian.org>

Subject: Re: Bug#860747: dh_ruby: please inject versioned dependency on ruby metapackage

Date: Wed, 19 Apr 2017 15:53:57 -0400

Hi, Antonio.  Thanks for the quick response!

Antonio Terceiro <terceiro@debian.org> writes:

> ruby-fast-xs is broken on m68k because it is a very old binary, from before
> this was implemented, and AFAICT it can't be built anymore because something
> else is not available.

The ruby-fast-xs version in play at the time (now superseded by a +b3
build against ruby 2.3) had, per
https://buildd.debian.org/status/fetch.php?pkg=ruby-fast-xs&arch=m68k&ver=0.8.0-3%2Bb2&stamp=1456486333&raw=0,

Depends: libc6 (>= 2.1.3), libgmp10, libruby2.2 (>= 2.2.0~1), ruby (>= 1:2.2)

However, there was (and still is) no upper bound on the ruby
metapackage's version, allowing for mismatches.

-- 
Aaron M. Ucko, KB1CJC (amu at alum.mit.edu, ucko at debian.org)
http://www.mit.edu/~amu/ | http://stuff.mit.edu/cgi/finger/?amu@monk.mit.edu

Message #20 received at 860747@bugs.debian.org (full text, mbox, reply):

From: Antonio Terceiro <terceiro@debian.org>

To: "Aaron M. Ucko" <ucko@debian.org>, 860747@bugs.debian.org

Subject: Re: Bug#860747: dh_ruby: please inject versioned dependency on ruby metapackage

Date: Wed, 19 Apr 2017 19:55:12 -0300

[Message part 1 (text/plain, inline)]

Control: reopen -1
Control: reassign -1 ruby-all-dev
Control: retitle -1 ruby-all-dev: include upper bound on generated ruby dependencies

On Wed, Apr 19, 2017 at 03:53:57PM -0400, Aaron M. Ucko wrote:
> Hi, Antonio.  Thanks for the quick response!
> 
> Antonio Terceiro <terceiro@debian.org> writes:
> 
> > ruby-fast-xs is broken on m68k because it is a very old binary, from before
> > this was implemented, and AFAICT it can't be built anymore because something
> > else is not available.
> 
> The ruby-fast-xs version in play at the time (now superseded by a +b3
> build against ruby 2.3) had, per
> https://buildd.debian.org/status/fetch.php?pkg=ruby-fast-xs&arch=m68k&ver=0.8.0-3%2Bb2&stamp=1456486333&raw=0,
> 
> Depends: libc6 (>= 2.1.3), libgmp10, libruby2.2 (>= 2.2.0~1), ruby (>= 1:2.2)
> 
> However, there was (and still is) no upper bound on the ruby
> metapackage's version, allowing for mismatches.

Ah fair enough, I missed that bit. These dependencies are specified in
ruby-all-dev, so I am reassigning accordingly. It should be just a
matter of including the << dependency there.

[signature.asc (application/pgp-signature, inline)]

Message #33 received at 860747@bugs.debian.org (full text, mbox, reply):

From: ucko@debian.org (Aaron M. Ucko)

To: Antonio Terceiro <terceiro@debian.org>

Cc: "Aaron M. Ucko" <ucko@debian.org>, <860747@bugs.debian.org>

Subject: Re: Bug#860747: dh_ruby: please inject versioned dependency on ruby metapackage

Date: Wed, 19 Apr 2017 21:10:33 -0400

Antonio Terceiro <terceiro@debian.org> writes:

> Ah fair enough, I missed that bit. These dependencies are specified in
> ruby-all-dev, so I am reassigning accordingly. It should be just a
> matter of including the << dependency there.

Sounds good, thanks!  Sorry for the sloppy reporting; I just got back
from vacation a couple of days ago, and was trying to sort out entirely
too many things at once.

-- 
Aaron M. Ucko, KB1CJC (amu at alum.mit.edu, ucko at debian.org)
http://www.mit.edu/~amu/ | http://stuff.mit.edu/cgi/finger/?amu@monk.mit.edu

Message #38 received at 860747@bugs.debian.org (full text, mbox, reply):

From: Julien Cristau <jcristau@debian.org>

To: "Aaron M. Ucko" <ucko@debian.org>, 860747@bugs.debian.org

Subject: Re: Bug#860747: dh_ruby: please inject versioned dependency on ruby metapackage

Date: Mon, 1 May 2017 13:12:19 +0200

On Wed, Apr 19, 2017 at 13:42:39 -0400, Aaron M. Ucko wrote:

> Package: gem2deb
> Version: 0.33.1
> Severity: normal
> 
> Please have compiled Ruby extensions depend on compatible versions of
> the ruby metapackage; for instance, an extension built only for 2.3
> would depend on ruby (>= 2.3), ruby (<< 2.4), and an extension built
> for both 2.3 and 2.4 would depend on ruby (>= 2.3), ruby (<< 2.5).
> (Python packaging settled on an analogous approach some time ago.)
> Ideally, this dependency would go to a dedicated ${ruby:Depends}
> substvar, but adding it to ${misc:Depends} would allow for much faster
> adoption.
> 
> As it stands, we can get situations like #860512, in which the m68k
> build of telegram-desktop failed because ruby 2.3 wound up paired with
> a ruby-fast-xs installation that only covered 2.2.  (The 0.8.0-3+b2
> m68k binNMU was intended to add 2.3 support, but accidentally picked
> up old metapackages.)  With an explicit versioned dependency in place,
> generic automated tools would have caught this problem.
> 
As this allows broken package combinations, it seems to me the severity
should be serious, not normal.

Cheers,
Julien

Message #43 received at 860747@bugs.debian.org (full text, mbox, reply):

From: Antonio Terceiro <terceiro@debian.org>

To: Julien Cristau <jcristau@debian.org>, 860747@bugs.debian.org

Cc: "Aaron M. Ucko" <ucko@debian.org>, debian-release@lists.debian.org

Subject: Re: Bug#860747: dh_ruby: please inject versioned dependency on ruby metapackage

Date: Wed, 3 May 2017 11:27:16 -0300

[Message part 1 (text/plain, inline)]

On Mon, May 01, 2017 at 01:12:19PM +0200, Julien Cristau wrote:
> On Wed, Apr 19, 2017 at 13:42:39 -0400, Aaron M. Ucko wrote:
> 
> > Package: gem2deb
> > Version: 0.33.1
> > Severity: normal
> > 
> > Please have compiled Ruby extensions depend on compatible versions of
> > the ruby metapackage; for instance, an extension built only for 2.3
> > would depend on ruby (>= 2.3), ruby (<< 2.4), and an extension built
> > for both 2.3 and 2.4 would depend on ruby (>= 2.3), ruby (<< 2.5).
> > (Python packaging settled on an analogous approach some time ago.)
> > Ideally, this dependency would go to a dedicated ${ruby:Depends}
> > substvar, but adding it to ${misc:Depends} would allow for much faster
> > adoption.
> > 
> > As it stands, we can get situations like #860512, in which the m68k
> > build of telegram-desktop failed because ruby 2.3 wound up paired with
> > a ruby-fast-xs installation that only covered 2.2.  (The 0.8.0-3+b2
> > m68k binNMU was intended to add 2.3 support, but accidentally picked
> > up old metapackages.)  With an explicit versioned dependency in place,
> > generic automated tools would have caught this problem.
> > 
> As this allows broken package combinations, it seems to me the severity
> should be serious, not normal.

fair enough. Can it algo be ignored for stretch? I reallt don't think we
should change that this late.

[signature.asc (application/pgp-signature, inline)]

Message #48 received at 860747@bugs.debian.org (full text, mbox, reply):

From: Julien Cristau <jcristau@debian.org>

To: Antonio Terceiro <terceiro@debian.org>, 860747@bugs.debian.org, "Aaron M. Ucko" <ucko@debian.org>, debian-release@lists.debian.org

Subject: Re: Bug#860747: dh_ruby: please inject versioned dependency on ruby metapackage

Date: Wed, 3 May 2017 17:11:29 +0200

Control: severity 860747 serious
Control: tag 860747 stretch-ignore jessie-ignore

On 05/03/2017 04:27 PM, Antonio Terceiro wrote:
> On Mon, May 01, 2017 at 01:12:19PM +0200, Julien Cristau wrote:
>> On Wed, Apr 19, 2017 at 13:42:39 -0400, Aaron M. Ucko wrote:
>>
>>> Package: gem2deb
>>> Version: 0.33.1
>>> Severity: normal
>>>
>>> Please have compiled Ruby extensions depend on compatible versions of
>>> the ruby metapackage; for instance, an extension built only for 2.3
>>> would depend on ruby (>= 2.3), ruby (<< 2.4), and an extension built
>>> for both 2.3 and 2.4 would depend on ruby (>= 2.3), ruby (<< 2.5).
>>> (Python packaging settled on an analogous approach some time ago.)
>>> Ideally, this dependency would go to a dedicated ${ruby:Depends}
>>> substvar, but adding it to ${misc:Depends} would allow for much faster
>>> adoption.
>>>
>>> As it stands, we can get situations like #860512, in which the m68k
>>> build of telegram-desktop failed because ruby 2.3 wound up paired with
>>> a ruby-fast-xs installation that only covered 2.2.  (The 0.8.0-3+b2
>>> m68k binNMU was intended to add 2.3 support, but accidentally picked
>>> up old metapackages.)  With an explicit versioned dependency in place,
>>> generic automated tools would have caught this problem.
>>>
>> As this allows broken package combinations, it seems to me the severity
>> should be serious, not normal.
> 
> fair enough. Can it algo be ignored for stretch? I reallt don't think we
> should change that this late.
> 
Sounds fair.

Thanks,
Julien

Message #61 received at 889470-submitter@bugs.debian.org (full text, mbox, reply):

From: terceiro@debian.org

To: 889470-submitter@bugs.debian.org

Subject: Bug #889470 in gem2deb marked as pending

Date: Mon, 26 Feb 2018 00:09:19 +0000

Control: tag -1 pending

Hello,

Bug #889470 in gem2deb reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below, and you can check the diff of the fix at:

https://salsa.debian.org/ruby-team/gem2deb/commit/85f15cd24ed50e907e34c145c141c34c8049d7e4

------------------------------------------------------------------------
dh_ruby_fixdepends: include upper bound on ruby versions

Closes: #889470

------------------------------------------------------------------------

(this message was generated automatically)
-- 
Greetings

Message #68 received at 889470-close@bugs.debian.org (full text, mbox, reply):

From: Cédric Boutillier <boutil@debian.org>

To: 889470-close@bugs.debian.org

Subject: Bug#889470: fixed in gem2deb 0.38

Date: Mon, 05 Mar 2018 13:19:48 +0000

Source: gem2deb
Source-Version: 0.38

We believe that the bug you reported is fixed in the latest version of
gem2deb, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 889470@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Cédric Boutillier <boutil@debian.org> (supplier of updated gem2deb package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sun, 04 Mar 2018 20:47:35 +0100
Source: gem2deb
Binary: gem2deb gem2deb-test-runner
Architecture: source
Version: 0.38
Distribution: unstable
Urgency: medium
Maintainer: Debian Ruby Extras Maintainers <pkg-ruby-extras-maintainers@lists.alioth.debian.org>
Changed-By: Cédric Boutillier <boutil@debian.org>
Description:
 gem2deb    - Debian Ruby packaging suite
 gem2deb-test-runner - Debian Ruby packaging suite - tool to run tests
Closes: 889470
Changes:
 gem2deb (0.38) unstable; urgency=medium
 .
   [ Antonio Terceiro ]
   * dh_ruby_fixdepends: include upper bound on ruby versions provided by
     ruby-all-dev (Closes: #889470)
   * dh_ruby --print-supported: respect order provided by ruby-all-dev
 .
   [ Cédric Boutillier ]
   * gem2tgz:
     - Deprecate SHA1, and replace by SHA256
     - Ensure that at least one of the checkable digests is listed in
       checksums.yaml.gz instead of forcing all of them to be available
Checksums-Sha1:
 51851414bd4fb0c6fd1b278f45c003a5c91fff61 1935 gem2deb_0.38.dsc
 31569dd6f2ee448538e24ba037c8da3990993d79 67836 gem2deb_0.38.tar.xz
 f48d6fa3903f9e3ab8805435295fd3ff460b119c 8720 gem2deb_0.38_source.buildinfo
Checksums-Sha256:
 7c4fa73849059227701310dbe52e24f73ef5e7d1ce7295697907e039e6c5ac25 1935 gem2deb_0.38.dsc
 17c0c46f868e20bcacf28882c414b0c396061c73454ec1ccec3073b34ee116a7 67836 gem2deb_0.38.tar.xz
 e08f4ead9a5bae428c096b291cce49175aab74988cda80ba46439238ba29608a 8720 gem2deb_0.38_source.buildinfo
Files:
 fb6f87f42b7edbae64143b7aff65aa0b 1935 ruby optional gem2deb_0.38.dsc
 5d16e07d82e23030960fe4cbc14e4b5e 67836 ruby optional gem2deb_0.38.tar.xz
 e0d554509b431040ce91948af28b9704 8720 ruby optional gem2deb_0.38_source.buildinfo

-----BEGIN PGP SIGNATURE-----

iQEzBAEBCgAdFiEEnM1rMZ2/jkCrGr0aia+CtznNIXoFAlqdP74ACgkQia+CtznN
IXoTLAgAjxoVFTpXWul8PSIp7zhY6PI8gHbYUmkfJfuyeU5JfrHjCqdxP8ykrV3i
q/8UO/J012TyJEQnDcuQc/FzXpM16kz+/GFNEc5zBRDU9BAVkGzvjX8w52XkNfJ2
dI06d7qe76MutASDafWs4GQ4VN2RZkC1em7TGN30bI0dZ8CcykpH//ED/ViOlo+d
F65+4UwO9CZbibOvldbyILGIbhPqskaS1F+IUtXtb8Ti6kh5aNdgIaGRa8ZfI5jX
epMtf4EsdgW+SLzbR9YstEnrnHZlmeVZLiy+sNoZuR6f1kA0HZLnQOxZ2BBFnuNE
gO9NvSPv7WGm4PfeZKPwaI2u+I/Ufg==
=fSks
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.