Bug 1134364 - Pulp yum repos are not working correctly when adding to a repo-product-CV a RPM package with name exactly equal to an already existing package (but with different content)
Summary: Pulp yum repos are not working correctly when adding to a repo-product-CV a R...
Keywords:
Status: CLOSED WONTFIX
Alias: None
Product: Red Hat Satellite
Classification: Red Hat
Component: Pulp
Version: 6.0.3
Hardware: Unspecified
OS: Unspecified
unspecified
medium
Target Milestone: Unspecified
Assignee: satellite6-bugs
QA Contact: Katello QA List
URL:
Whiteboard:
Depends On: 1145722
Blocks: sat6-pulp-future GSS_Sat6Beta_Tracker, GSS_Sat6_Tracker 1175448
TreeView+ depends on / blocked
 
Reported: 2014-08-27 11:50 UTC by Benjamin Chardi
Modified: 2021-04-06 18:03 UTC (History)
12 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
: 1145722 (view as bug list)
Environment:
Last Closed: 2015-03-30 19:36:45 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Pulp Redmine 541 0 High CLOSED - NOTABUG Pulp yum repos are not working correctly when adding to a repo-product-CV a RPM package with name exactly equal to an a... Never

Description Benjamin Chardi 2014-08-27 11:50:20 UTC
In some special scenarios (not very usual) where the user wants to keep the same RPM name (including version-release-arch) but with different content, pulp repos are not working as expected.


1.- Lets say that we have and RPM called pacuseri-1.1-1el.x86_64.rpm with content C1 and sha256sum "77e400c8b1d32a234022313566a5aa53592c27493c9e5b97895e82360ef3bcde" in a yum repo. We attach that repo to a Red Hat Satellite6 product and publish it in a CV. Then you install the package on client. -> OK

2.- Now we want to replace our original package with an improved version  that has the same name 'pacuseri-1.1-1el.x86_64.rpm' but with a different content C2 and sha256sum "89eaf9e7ec82abc6e0e6fddbe42160bc3eea41e5199853c654a91452042e6222". We copy the package to the yum repo, recreate repodata with "createrepo" command. Then we sync the new yum repo on Red Hat Satellite6 and publish a new version of the content view.  


When we try to install that package in a new client we get the following ERROR:

# yum clean all
Loaded plugins: package_upload, product-id, security, subscription-manager
This system is receiving updates from Red Hat Subscription Management.
Cleaning up Everything

# yum install pacuseri
Loaded plugins: package_upload, product-id, security, subscription-manager
This system is receiving updates from Red Hat Subscription Management.
itnow_RHEL5-SAT6-client_rhel5-sat6-client                                                                                   | 2.1 kB     00:00     
itnow_RHEL5-SAT6-client_rhel5-sat6-client/primary                                                                           | 7.3 kB     00:00     
itnow_RHEL5-SAT6-client_rhel5-sat6-client                                                                                                    24/24
itnow_telnet5_telnet5-repo                                                                                                  | 2.1 kB     00:00     
itnow_telnet5_telnet5-repo/primary                                                                                          | 1.8 kB     00:00     
itnow_telnet5_telnet5-repo                                                                                                                     4/4
Setting up Install Process
Resolving Dependencies
--> Running transaction check
---> Package pacuseri.x86_64 0:1.1-1el set to be updated
--> Finished Dependency Resolution

Dependencies Resolved

===================================================================================================================================================
 Package                        Arch                         Version                        Repository                                        Size
===================================================================================================================================================
Installing:
 pacuseri                       x86_64                       1.1-1el                        itnow_telnet5_telnet5-repo                       3.0 k

Transaction Summary
===================================================================================================================================================
Install       1 Package(s)
Upgrade       0 Package(s)

Total download size: 3.0 k
Is this ok [y/N]: y
Downloading Packages:
pacuseri-1.1-1el.x86_64.rpm                                                                                                 | 3.0 kB     00:00     
https://capsule.info.net/pulp/repos/itnow/Library/cv_telnet_ntp/custom/telnet5/telnet5-repo/pacuseri-1.1-1el.x86_64.rpm: [Errno -1] Package does not match intended download
Trying other mirror.


Error Downloading Packages:
  pacuseri-1.1-1el.x86_64: failure: pacuseri-1.1-1el.x86_64.rpm from itnow_telnet5_telnet5-repo: [Errno 256] No more mirrors to try.



I believe that this is because of pulp-yum-repo contains both 'pacuseri-1.1-1el.x86_64.rpm' RPM and when yum makes sha256sum comparative
 it not matches. Yum is trying to install the newest pacuseri RPM (OK) but is comparing using the oldest sha256sum contained in the new pulp-yum-repodata that contain both the oldest and the newest.


zgrep pacuseri /var/lib/pulp/published/yum/https/repos/itnow/Library/cv_telnet_ntp/custom/telnet5/telnet5-repo/repodata/f3bf435fb00ebc632685a746dddfb10dd5b6616a89aa7826bffcb976134c008f-primary.xml.gz 

  ... 
  <name>pacuseri</name>
   <checksum pkgid="YES" type="sha256">77e400c8b1d32a234022313566a5aa53592c27493c9e5b97895e82360ef3bcde</checksum>
  <summary>pacuseri application package</summary>
  <location href="pacuseri-1.1-1el.x86_64.rpm" />
    <rpm:sourcerpm >pacuseri-1.1-1el.src.rpm</rpm:sourcerpm>
      <rpm:entry epoch="0" flags="EQ" name="config(pacuseri)" rel="1el" ver="1.1" />
      <rpm:entry epoch="0" flags="EQ" name="pacuseri" rel="1el" ver="1.1" />
  <file>/etc/pacuseri.conf</file>
  <file>/usr/bin/pacuseri</file>
  
  ... 
  <name>pacuseri</name>
  <checksum pkgid="YES" type="sha256">89eaf9e7ec82abc6e0e6fddbe42160bc3eea41e5199853c654a91452042e6222</checksum>
  <summary>pacuseri application package</summary>
  <location href="pacuseri-1.1-1el.x86_64.rpm" />
    <rpm:sourcerpm >pacuseri-1.1-1el.src.rpm</rpm:sourcerpm>
      <rpm:entry epoch="0" flags="EQ" name="config(pacuseri)" rel="1el" ver="1.1" />
      <rpm:entry epoch="0" flags="EQ" name="pacuseri" rel="1el" ver="1.1" />
  <file>/etc/pacuseri.conf</file>
  <file>/usr/bin/pacuseri</file>

 ...

The newest pacuseri RPM is the one with sha256sum "89eaf9e7ec82abc6e0e6fddbe42160bc3eea41e5199853c654a91452042e6222" and yum is comparing (because of pulp-yum-repodata) it with the oldest sha256sum "77e400c8b1d32a234022313566a5aa53592c27493c9e5b97895e82360ef3bcde" and it fails.


I know that is not a best practice do not increment the RPM version number when a RPM is updated, but I think also that the pulp-rpm-repo must match exactly the same as  the original yum repo that manages and this is not the case. Why the old RPM is not removed from the pulp-yum-repo ???

Many thanks in advance ;)

Comment 1 RHEL Program Management 2014-08-27 11:53:57 UTC
Since this issue was entered in Red Hat Bugzilla, the release flag has been
set to ? to ensure that it is properly evaluated for this release.

Comment 3 Michael Hrivnak 2014-09-24 21:57:56 UTC
What is the correct behavior in this case? Should pulp replace the previous rpm with the new one? Or should it ignore the new one and keep the old one?

If there is any change to code or packaging, the NEVRA must be different. If we can assume that both RPMs are different builds of the exact same bits (spec file and all), then it shouldn't matter which one is in the repo.

I'm also concerned about this turning into a broader validation feature. Should we run similar checks on upload and copy operations? What are the correct behaviors in those cases? On a large repo, such validation has the potential to noticeably impact performance. Can we limit the scope of this to say that we'll help prevent duplicate NEVRA when they come from an upstream source, but the user is expected to not make local modifications (copy or upload) that result in duplicate NEVRA?

Comment 4 Michael Hrivnak 2014-12-17 20:30:40 UTC
Following-up, I propose that within the world of rpm packaging, if you change the bits or spec file, you must increment at least one of the epoch, version, or release.

Can we tell the user that changing the bits without bumping EVR is not supported by rpm, yum, or satellite?

Comment 6 Mike McCune 2015-03-30 19:36:45 UTC
+1 to Michael's comment #4, if you change an RPM, increment one of the fields that indicates that the RPM has changed and do not rely entirely on the hash.

Going to CLOSE:WONTFIX but if you feel this is going to have a major impact feel free to re-open with justification.

Comment 7 pulp-infra@redhat.com 2015-03-30 20:00:34 UTC
The Pulp upstream bug status is at CLOSED - NOTABUG. Updating the external tracker on this bug.

Comment 8 Michael Hrivnak 2016-03-29 16:22:26 UTC
I don't think we need additional info anymore.


Note You need to log in before you can comment on or make changes to this bug.