Bug 1028706 - openscap update incorrectly pulls in piles of 32bit packages
openscap update incorrectly pulls in piles of 32bit packages
Status: CLOSED ERRATA
Product: Fedora
Classification: Fedora
Component: openscap (Show other bugs)
19
Unspecified Unspecified
unspecified Severity unspecified
: ---
: ---
Assigned To: Šimon Lukašík
Fedora Extras Quality Assurance
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2013-11-09 14:50 EST by Kevin Fenzi
Modified: 2013-12-06 11:28 EST (History)
7 users (show)

See Also:
Fixed In Version: scap-workbench-0.8.2-2.fc19
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2013-12-04 01:57:32 EST
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Kevin Fenzi 2013-11-09 14:50:29 EST
# rpm -q openscap
openscap-0.9.12-1.fc19.x86_64

# yum upgrade openscap
...
Dependencies Resolved

====================================================================================================
 Package                    Arch          Version                      Repository              Size
====================================================================================================
Installing:
 openscap                   i686          0.9.13-3.fc19                updates-testing        2.5 M
     replacing  openscap-content.noarch 0.9.12-1.fc19
 openscap                   x86_64        0.9.13-3.fc19                updates-testing        2.5 M
     replacing  openscap-content.noarch 0.9.12-1.fc19
Installing for dependencies:
 bzip2-libs                 i686          1.0.6-8.fc19               
...
Install  2 Packages (+41 Dependent packages)
Upgrade             (  1 Dependent package)

You likely have an obsoletes without %{_isa} or the like.
Comment 1 Šimon Lukašík 2013-11-09 15:30:53 EST
Thanks for report!
Comment 2 Šimon Lukašík 2013-11-09 18:01:27 EST
The %{?_isa} thing seem to make the problem only worse.

Without %{?_isa}:
    $ rpm -qp --obsoletes openscap-0.9.13-3.fc19.x86_64.rpm
    openscap-content
That brings i686, only if present in repo.
With %{?_isa}:
    $ rpm -qp --obsoletes openscap-0.9.13-5.fc19.x86_64.rpm
    openscap-content(x86-64) <= 0.9.13-5
This requires i686 even when missing.

We experience the problem because the old (obsoleted) openscap-content
sub-package requires base package without specifying the %{_isa}.
That seems to break the rulebook at

    Packaging:Guidelines#Requiring_Base_Package

And might be what bringing i686 color into the consideration.
Comment 3 Šimon Lukašík 2013-11-14 12:25:56 EST
First of all, a part of my previous comment was wrong. OpenSCAP has
followed the guidelines by requiring openscap by openscap-content
without specifying architecture.

Second, using obsoletes with %{?_isa} tag makes it worse.

Next, let me quote Petr Lautrbach:
> It does not affect dnf, only yum.

And bug 667984 comment 3:
> <skvidal> so - yum has for quite a while done "install all pkgs which obsolete 
> an installed pkg" - mostly working on the assumption that choosing b/t two 
> obsoleting pkgs is pretty much impossible
Comment 4 Šimon Lukašík 2013-11-15 05:17:27 EST
The proper solution would be to include 

    Obsoletes:      openscap-content < 0:0.9.13

in scap-security-guide.spec and remove the obsoletes line
from openscap.spec.
Comment 6 Fedora Update System 2013-11-15 08:17:46 EST
openscap-0.9.13-7.fc19,scap-security-guide-0.1-3.1.fc19 has been submitted as an update for Fedora 19.
https://admin.fedoraproject.org/updates/openscap-0.9.13-7.fc19,scap-security-guide-0.1-3.1.fc19
Comment 7 Fedora Update System 2013-11-16 02:06:42 EST
Package openscap-0.9.13-7.fc19, scap-security-guide-0.1-3.1.fc19:
* should fix your issue,
* was pushed to the Fedora 19 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing openscap-0.9.13-7.fc19 scap-security-guide-0.1-3.1.fc19'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2013-21476/openscap-0.9.13-7.fc19,scap-security-guide-0.1-3.1.fc19
then log in and leave karma (feedback).
Comment 8 Fedora Update System 2013-11-25 10:00:57 EST
scap-workbench-0.8.2-2.fc19,openscap-1.0.0-2.fc19,scap-security-guide-0.1-3.1.fc19 has been submitted as an update for Fedora 19.
https://admin.fedoraproject.org/updates/scap-workbench-0.8.2-2.fc19,openscap-1.0.0-2.fc19,scap-security-guide-0.1-3.1.fc19
Comment 9 Fedora Update System 2013-12-04 01:57:32 EST
scap-workbench-0.8.2-2.fc19, openscap-1.0.0-2.fc19, scap-security-guide-0.1-3.1.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 10 Mike Rubel 2013-12-05 16:22:13 EST
Running yum update on one of my F19 systems now fails (it worked before), and I think it may be related to this change.  Transcript:

# yum update
Loaded plugins: langpacks, refresh-packagekit
Resolving Dependencies
--> Running transaction check
---> Package openscap.x86_64 0:0.9.12-1.fc19 will be updated
---> Package openscap.x86_64 0:1.0.0-2.fc19 will be an update
--> Processing Dependency: openscap-engine-sce = 1.0.0-2.fc19 for package: openscap-1.0.0-2.fc19.x86_64
---> Package openscap-content.noarch 0:0.9.12-1.fc19 will be obsoleted
--> Processing Dependency: openscap-content >= 0.7.2 for package: firstaidkit-plugin-openscap-0.3.2-6.fc19.noarch
---> Package openscap-python.x86_64 0:0.9.12-1.fc19 will be updated
---> Package openscap-python.x86_64 0:1.0.0-2.fc19 will be an update
---> Package scap-security-guide.noarch 0:0.1-3.1.fc19 will be obsoleting
--> Processing Dependency: openscap-utils >= 0.9.1 for package: scap-security-guide-0.1-3.1.fc19.noarch
--> Running transaction check
---> Package openscap-content.noarch 0:0.9.12-1.fc19 will be obsoleted
--> Processing Dependency: openscap-content >= 0.7.2 for package: firstaidkit-plugin-openscap-0.3.2-6.fc19.noarch
---> Package openscap-engine-sce.x86_64 0:1.0.0-2.fc19 will be installed
---> Package openscap-utils.x86_64 0:1.0.0-2.fc19 will be installed
--> Processing Dependency: rpmdevtools for package: openscap-utils-1.0.0-2.fc19.x86_64
--> Processing Dependency: rpm-build for package: openscap-utils-1.0.0-2.fc19.x86_64
--> Running transaction check
---> Package openscap-content.noarch 0:0.9.12-1.fc19 will be obsoleted
--> Processing Dependency: openscap-content >= 0.7.2 for package: firstaidkit-plugin-openscap-0.3.2-6.fc19.noarch
---> Package rpm-build.x86_64 0:4.11.1-3.fc19 will be installed
--> Processing Dependency: patch >= 2.5 for package: rpm-build-4.11.1-3.fc19.x86_64
---> Package rpmdevtools.noarch 0:8.3-3.fc19 will be installed
--> Processing Dependency: fakeroot for package: rpmdevtools-8.3-3.fc19.noarch
--> Running transaction check
---> Package fakeroot.x86_64 0:1.18.4-2.fc19 will be installed
--> Processing Dependency: fakeroot-libs = 1.18.4-2.fc19 for package: fakeroot-1.18.4-2.fc19.x86_64
---> Package openscap-content.noarch 0:0.9.12-1.fc19 will be obsoleted
--> Processing Dependency: openscap-content >= 0.7.2 for package: firstaidkit-plugin-openscap-0.3.2-6.fc19.noarch
---> Package patch.x86_64 0:2.7.1-6.fc19 will be installed
--> Running transaction check
---> Package fakeroot-libs.x86_64 0:1.18.4-2.fc19 will be installed
---> Package openscap-content.noarch 0:0.9.12-1.fc19 will be obsoleted
--> Processing Dependency: openscap-content >= 0.7.2 for package: firstaidkit-plugin-openscap-0.3.2-6.fc19.noarch
--> Finished Dependency Resolution
Error: Package: firstaidkit-plugin-openscap-0.3.2-6.fc19.noarch (@fedora)
           Requires: openscap-content >= 0.7.2
           Removing: openscap-content-0.9.12-1.fc19.noarch (@updates)
               openscap-content = 0.9.12-1.fc19
           Obsoleted By: scap-security-guide-0.1-3.1.fc19.noarch (updates)
               Not found
           Available: openscap-content-0.9.7-1.fc19.noarch (fedora)
               openscap-content = 0.9.7-1.fc19
 You could try using --skip-broken to work around the problem
 You could try running: rpm -Va --nofiles --nodigest

I already ran it once with --skip-broken.  Being unfamiliar with these packages, I would be grateful for any suggestions.
Comment 11 Šimon Lukašík 2013-12-06 04:22:31 EST
Ah, I see. The problem is brought by firstaidkit-plugin-openscap
package Which requires openscap-content greater than given specific version/release.

firstaidkit package is obsoleted in all Fedoras. Perhaps, the project
is not that vital any more. I think, I cannot fix your problem without
proven-packager intervention (Assumes I don't want to add version/release provides to scap-securityu-guide).

Are you actually using firstaidkit-plugin-openscap? Can you volunteer
to maintain it in Fedora? Otherwise, perhaps, you can remove that package.

 # yum remove firstaidkit-plugin-openscap
 # yum update openscap
Comment 12 Mike Rubel 2013-12-06 11:28:39 EST
Thanks, removing firstaidkit-plugin-openscap did the trick, and I removed the rest of firstaidkit as well.  Since I didn't explicitly install firstaidkit (I don't even know what it is!), it must have been placed there by the installer, which is puzzling for a package that should be obsolete.  If I can figure out why it was installed, I'll submit a bug.

In any case, thanks.  I can now run yum update.

Note You need to log in before you can comment on or make changes to this bug.