Bug 1149531

Summary:	Bug in createrepo causes primary.xml to have incorrect version strings
Product:	Red Hat Enterprise Linux 7	Reporter:	joe
Component:	createrepo	Assignee:	James Antill <james.antill>
Status:	CLOSED NOTABUG	QA Contact:	BaseOS QE Security Team <qe-baseos-security>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	7.2	CC:	james.antill, thomas.oulevey
Target Milestone:	rc
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2014-10-20 21:05:51 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description joe 2014-10-05 20:45:26 UTC

Description of problem:

createrepo computes version strings differently than librpm causing primary.xml metadata to list an incorrect version and release string.

This bug was originally fixed in commit 2269134f119ce13d6a9b725f94954d9dd629f427 in the createrepo git repository, but appears to have been lost during a major internal refactor of createrepo.


Version-Release number of selected component (if applicable):


How reproducible:
Every time


Steps to Reproduce:
A simple test case showing buggy metadata for one package:

0. Install createrepo
1. Download the plexus-cdc-1.0-0.20.a14.el7.noarch.rpm package
2. Run createrepo . in a directory containing plexus-cdc-1.0-0.20.a14.el7.noarch.rpm
3. Read the primary xml metadata

Actual results:

In the provides section of primary.xml.gz:

<rpm:entry name="mvn(org.codehaus.plexus:plexus-cdc)" flags="EQ" epoch="0" ver="1.0" rel="alpha-14"/>

Expected results:

<rpm:entry epoch="0" flags="EQ" name="mvn(org.codehaus.plexus:plexus-cdc)" rel="14" ver="1.0-alpha"/>

Additional info:

Comment 2 joe 2014-10-06 17:19:30 UTC

Also, I forgot to add that any existing repositories that were generated using this version of createrepo have incorrect metadata showing wrong version and release strings.

Might be a good idea for any important repositories to have their metadata regenerated once this bug is fixed.

Comment 3 James Antill 2014-10-20 21:05:51 UTC

This bug is incorrect, version or release strings cannot have a '-' character in them. Only the name can.

rpmbuild has recently been fixed to flag these errors, although I believe the one shipped in rhel-7.0 still lets them through.
Although believe I manually checked all of the packages we shipped for rhel-7, so that none have problem. If you've found any shipped by us though, feel free to open bugs.

Comment 4 James Antill 2014-10-20 21:13:57 UTC

FYI, this is the upstream rpmbuild fix:

http://rpm.org/gitweb?p=rpm.git;a=commitdiff;h=b2cf1471bbe2c35e3c36510a9e3f59919d8ed2c8

Comment 5 joe 2014-10-20 21:16:21 UTC

I ran a scan using a script I wrote (which could be wrong) that says these packages have issues:

base64coder-20101219-10.el7.noarch.rpm
httpd-2.4.6-17.el7.centos.1.x86_64.rpm
maven-repository-builder-1.0-0.5.alpha2.el7.noarch.rpm
plexus-ant-factory-1.0-0.12.a2.3.el7.noarch.rpm
plexus-bsh-factory-1.0-0.14.a7.el7.noarch.rpm
plexus-cdc-1.0-0.20.a14.el7.noarch.rpm
plexus-component-api-1.0-0.16.alpha15.el7.noarch.rpm
plexus-component-factories-pom-1.0-0.7.alpha11.el7.noarch.rpm
plexus-i18n-1.0-0.6.b10.4.el7.noarch.rpm
plexus-interactivity-1.0-0.14.alpha6.el7.noarch.rpm
plexus-mail-sender-1.0-1.a2.25.el7.noarch.rpm
plexus-resources-1.0-0.15.a7.el7.noarch.rpm

Not sure if these are RHEL-shipped/owned packages or not, sorry.