In some special scenarios (not very usual) where the user wants to keep the same RPM name (including version-release-arch) but with different content, pulp repos are not working as expected. 1.- Lets say that we have and RPM called pacuseri-1.1-1el.x86_64.rpm with content C1 and sha256sum "77e400c8b1d32a234022313566a5aa53592c27493c9e5b97895e82360ef3bcde" in a yum repo. We attach that repo to a Red Hat Satellite6 product and publish it in a CV. Then you install the package on client. -> OK 2.- Now we want to replace our original package with an improved version that has the same name 'pacuseri-1.1-1el.x86_64.rpm' but with a different content C2 and sha256sum "89eaf9e7ec82abc6e0e6fddbe42160bc3eea41e5199853c654a91452042e6222". We copy the package to the yum repo, recreate repodata with "createrepo" command. Then we sync the new yum repo on Red Hat Satellite6 and publish a new version of the content view. When we try to install that package in a new client we get the following ERROR: # yum clean all Loaded plugins: package_upload, product-id, security, subscription-manager This system is receiving updates from Red Hat Subscription Management. Cleaning up Everything # yum install pacuseri Loaded plugins: package_upload, product-id, security, subscription-manager This system is receiving updates from Red Hat Subscription Management. itnow_RHEL5-SAT6-client_rhel5-sat6-client | 2.1 kB 00:00 itnow_RHEL5-SAT6-client_rhel5-sat6-client/primary | 7.3 kB 00:00 itnow_RHEL5-SAT6-client_rhel5-sat6-client 24/24 itnow_telnet5_telnet5-repo | 2.1 kB 00:00 itnow_telnet5_telnet5-repo/primary | 1.8 kB 00:00 itnow_telnet5_telnet5-repo 4/4 Setting up Install Process Resolving Dependencies --> Running transaction check ---> Package pacuseri.x86_64 0:1.1-1el set to be updated --> Finished Dependency Resolution Dependencies Resolved =================================================================================================================================================== Package Arch Version Repository Size =================================================================================================================================================== Installing: pacuseri x86_64 1.1-1el itnow_telnet5_telnet5-repo 3.0 k Transaction Summary =================================================================================================================================================== Install 1 Package(s) Upgrade 0 Package(s) Total download size: 3.0 k Is this ok [y/N]: y Downloading Packages: pacuseri-1.1-1el.x86_64.rpm | 3.0 kB 00:00 https://capsule.info.net/pulp/repos/itnow/Library/cv_telnet_ntp/custom/telnet5/telnet5-repo/pacuseri-1.1-1el.x86_64.rpm: [Errno -1] Package does not match intended download Trying other mirror. Error Downloading Packages: pacuseri-1.1-1el.x86_64: failure: pacuseri-1.1-1el.x86_64.rpm from itnow_telnet5_telnet5-repo: [Errno 256] No more mirrors to try. I believe that this is because of pulp-yum-repo contains both 'pacuseri-1.1-1el.x86_64.rpm' RPM and when yum makes sha256sum comparative it not matches. Yum is trying to install the newest pacuseri RPM (OK) but is comparing using the oldest sha256sum contained in the new pulp-yum-repodata that contain both the oldest and the newest. zgrep pacuseri /var/lib/pulp/published/yum/https/repos/itnow/Library/cv_telnet_ntp/custom/telnet5/telnet5-repo/repodata/f3bf435fb00ebc632685a746dddfb10dd5b6616a89aa7826bffcb976134c008f-primary.xml.gz ... <name>pacuseri</name> <checksum pkgid="YES" type="sha256">77e400c8b1d32a234022313566a5aa53592c27493c9e5b97895e82360ef3bcde</checksum> <summary>pacuseri application package</summary> <location href="pacuseri-1.1-1el.x86_64.rpm" /> <rpm:sourcerpm >pacuseri-1.1-1el.src.rpm</rpm:sourcerpm> <rpm:entry epoch="0" flags="EQ" name="config(pacuseri)" rel="1el" ver="1.1" /> <rpm:entry epoch="0" flags="EQ" name="pacuseri" rel="1el" ver="1.1" /> <file>/etc/pacuseri.conf</file> <file>/usr/bin/pacuseri</file> ... <name>pacuseri</name> <checksum pkgid="YES" type="sha256">89eaf9e7ec82abc6e0e6fddbe42160bc3eea41e5199853c654a91452042e6222</checksum> <summary>pacuseri application package</summary> <location href="pacuseri-1.1-1el.x86_64.rpm" /> <rpm:sourcerpm >pacuseri-1.1-1el.src.rpm</rpm:sourcerpm> <rpm:entry epoch="0" flags="EQ" name="config(pacuseri)" rel="1el" ver="1.1" /> <rpm:entry epoch="0" flags="EQ" name="pacuseri" rel="1el" ver="1.1" /> <file>/etc/pacuseri.conf</file> <file>/usr/bin/pacuseri</file> ... The newest pacuseri RPM is the one with sha256sum "89eaf9e7ec82abc6e0e6fddbe42160bc3eea41e5199853c654a91452042e6222" and yum is comparing (because of pulp-yum-repodata) it with the oldest sha256sum "77e400c8b1d32a234022313566a5aa53592c27493c9e5b97895e82360ef3bcde" and it fails. I know that is not a best practice do not increment the RPM version number when a RPM is updated, but I think also that the pulp-rpm-repo must match exactly the same as the original yum repo that manages and this is not the case. Why the old RPM is not removed from the pulp-yum-repo ??? Many thanks in advance ;)
Since this issue was entered in Red Hat Bugzilla, the release flag has been set to ? to ensure that it is properly evaluated for this release.
What is the correct behavior in this case? Should pulp replace the previous rpm with the new one? Or should it ignore the new one and keep the old one? If there is any change to code or packaging, the NEVRA must be different. If we can assume that both RPMs are different builds of the exact same bits (spec file and all), then it shouldn't matter which one is in the repo. I'm also concerned about this turning into a broader validation feature. Should we run similar checks on upload and copy operations? What are the correct behaviors in those cases? On a large repo, such validation has the potential to noticeably impact performance. Can we limit the scope of this to say that we'll help prevent duplicate NEVRA when they come from an upstream source, but the user is expected to not make local modifications (copy or upload) that result in duplicate NEVRA?
Following-up, I propose that within the world of rpm packaging, if you change the bits or spec file, you must increment at least one of the epoch, version, or release. Can we tell the user that changing the bits without bumping EVR is not supported by rpm, yum, or satellite?
+1 to Michael's comment #4, if you change an RPM, increment one of the fields that indicates that the RPM has changed and do not rely entirely on the hash. Going to CLOSE:WONTFIX but if you feel this is going to have a major impact feel free to re-open with justification.
The Pulp upstream bug status is at CLOSED - NOTABUG. Updating the external tracker on this bug.
I don't think we need additional info anymore.