Bug 1417601

Summary: dnf - missing error message
Product: [Fedora] Fedora Reporter: Eduard Vopicka <eduard.vopicka>
Component: dnfAssignee: rpm-software-management
Status: CLOSED WONTFIX QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: high Docs Contact:
Priority: unspecified    
Version: 25CC: packaging-team-maint, rpm-software-management, vmukhame
Target Milestone: ---Keywords: Reopened
Target Release: ---   
Hardware: i686   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2017-01-30 20:04:22 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Eduard Vopicka 2017-01-30 12:04:55 UTC 
Description of problem: Error or warning message about unsatified dependencies missing when trying to update set of packages specified on command line. Possible functional or security consequences.


Version-Release number of selected component (if applicable):
[vopicka@czlx-vopicka tmp]$ rpm -q dnf
dnf-1.1.10-5.fc25.noarch
[vopicka@czlx-vopicka tmp]$ 


How reproducible:
Always with repo in such a state that dependencies cannot be resolved.


Steps to Reproduce:
1. I am trying to update my almost up-to-date fedora 25. Skipped packages with broken dependencies are correctly reported:
[root@czlx-vopicka ~]# dnf update
Last metadata expiration check: 1:07:59 ago on Mon Jan 30 11:31:12 2017.
Dependencies resolved.
================================================================================
 Package                 Arch         Version               Repository     Size
================================================================================
Skipping packages with broken dependencies:
 mesa-libEGL             x86_64       13.0.3-4.fc25         updates       103 k
 mesa-libEGL-devel       x86_64       13.0.3-4.fc25         updates        38 k
 mesa-libGL              x86_64       13.0.3-4.fc25         updates       164 k
 mesa-libGL-devel        x86_64       13.0.3-4.fc25         updates       161 k
 mesa-libGLES            x86_64       13.0.3-4.fc25         updates        21 k
 mesa-libglapi           x86_64       13.0.3-4.fc25         updates        49 k

Transaction Summary
================================================================================
Skip  6 Packages

Nothing to do.
Complete!
[root@czlx-vopicka ~]# 

2. Now I am trying to update packages reported in step 1. No packages with broken dependencies are reported this time, only "Nothing to do":

[root@czlx-vopicka ~]# dnf update mesa-libEGL mesa-libEGL-devel mesa-libGL mesa-libGL-devel mesa-libGLES mesa-libglapi
Last metadata expiration check: 1:11:45 ago on Mon Jan 30 11:31:12 2017.
Dependencies resolved.
Nothing to do.
Complete!
[root@czlx-vopicka ~]#

3. (Here you can try again "dnf update" as in step 1 to verify that their broken dependencies still exist.)

[root@czlx-vopicka ~]# dnf update
Last metadata expiration check: 1:13:30 ago on Mon Jan 30 11:31:12 2017.
Dependencies resolved.
================================================================================
 Package                 Arch         Version               Repository     Size
================================================================================
Skipping packages with broken dependencies:
 mesa-libEGL             x86_64       13.0.3-4.fc25         updates       103 k
 mesa-libEGL-devel       x86_64       13.0.3-4.fc25         updates        38 k
 mesa-libGL              x86_64       13.0.3-4.fc25         updates       164 k
 mesa-libGL-devel        x86_64       13.0.3-4.fc25         updates       161 k
 mesa-libGLES            x86_64       13.0.3-4.fc25         updates        21 k
 mesa-libglapi           x86_64       13.0.3-4.fc25         updates        49 k

Transaction Summary
================================================================================
Skip  6 Packages

Nothing to do.
Complete!
[root@czlx-vopicka ~]# 



Actual results:
No packeges with broken dependencies reported in step 2.


Expected results:
Packages with broken dependencies should be reported in step 2.

Additional info:
[root@czlx-vopicka ~]# uname -a
Linux czlx-vopicka.ad.ifortuna.cz 4.9.5-200.fc25.x86_64 #1 SMP Fri Jan 20 12:24:16 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux
[root@czlx-vopicka ~]# 

I am considering this to be serious problem because of it may lead to packages with broken dependencies being SILENTLY NOT UPDATED, even when they are in repo. and should be reported as packages with broken dependencies.i This may have functional or security consequences - you are not warned that there is a problem with these packages and packages are just silently ignored.

Plase note that my idea in step 2 was to add --enablerepo=fedora-testing in the next run to get packages missing in the fedora repo from fedora-updates. This is also the reason for having packages specified on command line, e.g. to get only minimum set of required packages from fedora-testing.

[root@czlx-vopicka ~]# dnf update --enablerepo=updates-testing mesa-libEGL mesa-libEGL-devel mesa-libGL mesa-libGL-devel mesa-libGLES mesa-libglapi
Fedora 25 - x86_64 - Test Updates                10 MB/s | 6.1 MB     00:00    
Last metadata expiration check: 0:00:02 ago on Mon Jan 30 12:50:45 2017.
Dependencies resolved.
================================================================================
 Package             Arch   Version                       Repository       Size
================================================================================
Installing:
 libglvnd            x86_64 1:0.2.999-7.gitdc16f8c.fc25   updates-testing  88 k
 libglvnd-core-devel x86_64 1:0.2.999-7.gitdc16f8c.fc25   updates-testing  19 k
 libglvnd-devel      x86_64 1:0.2.999-7.gitdc16f8c.fc25   updates-testing  11 k
 libglvnd-egl        x86_64 1:0.2.999-7.gitdc16f8c.fc25   updates-testing  42 k
 libglvnd-gles       x86_64 1:0.2.999-7.gitdc16f8c.fc25   updates-testing  30 k
 libglvnd-glx        x86_64 1:0.2.999-7.gitdc16f8c.fc25   updates-testing 124 k
 libglvnd-opengl     x86_64 1:0.2.999-7.gitdc16f8c.fc25   updates-testing  43 k
Upgrading:
 mesa-libEGL         x86_64 13.0.3-4.fc25                 updates         103 k
 mesa-libEGL-devel   x86_64 13.0.3-4.fc25                 updates          38 k
 mesa-libGL          x86_64 13.0.3-4.fc25                 updates         164 k
 mesa-libGL-devel    x86_64 13.0.3-4.fc25                 updates         161 k
 mesa-libGLES        x86_64 13.0.3-4.fc25                 updates          21 k
 mesa-libglapi       x86_64 13.0.3-4.fc25                 updates          49 k

Transaction Summary
================================================================================
Install  7 Packages
Upgrade  6 Packages

Total download size: 894 k
Is this ok [y/N]:
Comment 1 Igor Gnatenko 2017-01-30 12:25:44 UTC 
Usual users should not notice problems with dependencies, only developers or advanced users. Use --best if you want to see error.
Comment 2 Eduard Vopicka 2017-01-30 19:51:49 UTC 
Hello.

I would like to point out the following:

1) The missing message is certainly ERROR message and in no way anything like notice or something similar.

2) Ending with packages not updated w/o any error message in some cases can certainly have functional or evwn worse security impact on the system.

3) In my opinion, the current dnf behavior is exact opposite of what you are writing. "Usual user", if using dnf from comamnd line at all, will certainly use just "dnf update", while the "advanced user" od "developer"  will possibly use "dnf update package_name ..." But "usual user's" command gives proper error message and the "advanced user's" does not display error message". So the error message is not hiden for usual users, but instead for advanced users and developers.

4) Oldschool yum behaves correctly in this case.

[root@localhost ~]# yum-deprecated update --skip-broken  mesa-libEGL mesa-libEGL-devel mesa-libGL mesa-libGL-devel mesa-libGLES         mesa-libOSMesa mesa-libglapi  
### Lots of messages from yum dependency solving removed here. But finally:
Packages skipped because of dependency problems:
    libglvnd-0.2.999-6.git28867bb.fc25.i686 from fedora
    libglvnd-devel-0.2.999-6.git28867bb.fc25.i686 from fedora
    mesa-libEGL-13.0.3-4.fc25.i686 from updates
    mesa-libEGL-devel-13.0.3-4.fc25.i686 from updates
    mesa-libGL-13.0.3-4.fc25.i686 from updates
    mesa-libGL-devel-13.0.3-4.fc25.i686 from updates
    mesa-libGLES-13.0.3-4.fc25.i686 from updates
    mesa-libOSMesa-13.0.3-4.fc25.i686 from updates
    mesa-libglapi-13.0.3-4.fc25.i686 from updates
[root@localhost ~]# 

5) The mesaages we are talking about are significant ERROR messages, so they should not be hidden in any case.

Best regards,

Ed
Comment 3 Igor Gnatenko 2017-01-30 20:04:22 UTC 
Users do not need to report such bugs (that's why `best` is set to false by default). It's job of developers to prevent this. and even it happened it should not break other system updates.