Bug 1369185 - spacewalk-clone-by-date *must* clone errata when needed for dependency resolution
Summary: spacewalk-clone-by-date *must* clone errata when needed for dependency resolu...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Satellite 5
Classification: Red Hat
Component: Other
Version: 570
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Grant Gainey
QA Contact: Radovan Drazny
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2016-08-22 15:30 UTC by Grant Gainey
Modified: 2016-11-07 13:38 UTC (History)
2 users (show)

Fixed In Version: spacewalk-utils-2.3.2-29-sat
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2016-11-07 13:38:28 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2016:2662 0 normal SHIPPED_LIVE Satellite 5.7 bug fix update 2016-11-07 18:37:17 UTC

Description Grant Gainey 2016-08-22 15:30:52 UTC
Description of problem:

In BZ#974372 #c24, we explain why we clone the errata that delivered the RPMs that we need to complete dependency-resolution in spacewalk-clone-by-date

In BZ#1166673 we *undid* this behavior in response to a report that didn't understand why that behavior was happening.

As noted in '372, the complete-errata-clone was introduced in order to prevent some very subtle dependency-reolution issues from biting the cloned channel. The behavior has to be put back, and documentation/customer expectation set correctly.

How reproducible:

From BZ#1166673 #c12 and #c8:
===
Reproduced on Satellite 5.7.0 using following version of spacewalk-utils

Name        : spacewalk-utils
Arch        : noarch
Version     : 2.3.2
Release     : 18.el6sat

with following channels synced:

rhel-x86_64-server-6
rhel-x86_64-server-optional-6

Basically used the reproducer in comment #3, with following debug.conf file:

{
        "username": "admin",
        "password": "nimda",
        "assumeyes": true,
        "skip_depsolve": false,
        "security_only": false,
        "blacklist": {
                "ALL": [
                ]
        },
        "removelist": {
                "ALL": [
                                ""
                ]
        },
        "channels": {
                "rhel-x86_64-server-6": "debug2-rhel6-x86_64-server-6",
                "rhel-x86_64-server-optional-6": "debug2-rhel-x86_64-server-optional-6"
        }
}

I have run the command "spacewalk-clone-by-date --config=debug.conf -d 2013-11-20". 
                         8/29/14 
===


Actual results: (with '673 applied, #c12)
===
After checking newly cloned channels in Satellite WebUI, they now contain only correct errata (released before or on 2013-11-20). 
===

Expected results: (after rolling back '673, #c8)
===
After the cloning was finished, new channels contained beside erratas released <= 2013-11-20 following extra erratas:

Channel: debug2-rhel-x86_64-server-optional-6

CL-BA-2014:0750 pulseaudio bug fix update 	                10/13/14
CL-BA-2014:0586 gettext bug fix update 	                        10/13/14
CL-BA-2014:0749 mobile-broadband-provider-info bug fix update 	10/13/14
CL-BA-2014:1531 ccid bug fix update 	                        10/13/14
CL-EA-2014:1472 elfutils bug fix and enhancement update 	10/13/14
CL-BA-2014:1460 hal bug fix and enhancement update 	        10/13/14
CL-BA-2014:1449 systemtap bug fix and enhancement update 	10/13/14
CL-BA-2014:1548 mod_nss bug fix update 	                        10/13/14
CL-BA-2014:1506 cmake bug fix and enhancement update 	        10/13/14
CL-BA-2014:1561 libsoup bug fix and enhancement update 	        10/13/14
CL-BA-2014:1585 gnome-session bug fix and enhancement update 	10/13/14
CL-BA-2014:1583 slapi-nis bug fix update 	                10/13/14
CL-BA-2014:1406 dhcp bug fix update 	                        10/13/14
CL-BA-2014:1577 new packages: glib-networking 	                10/13/14
CL-BA-2014:1550 tomcatjss bug fix update 	                10/13/14
CL-SA-2014:0889 Critical: java-1.7.0-openjdk security update 	7/16/14 

Channel: debug2-rhel6-x86_64-server-6 

CL-BA-2015:0926 nss, nss-util, and nspr bug fix and enhancement update 	  5/5/15
CL-SA-2014:1652 Important: openssl security update 	                10/16/14
CL-BA-2014:0750 pulseaudio bug fix update 	                        10/13/14
CL-BA-2014:0586 gettext bug fix update 	                                10/13/14
CL-BA-2014:1561 libsoup bug fix and enhancement update 	                10/13/14
CL-BA-2014:1577 new packages: glib-networking 	                        10/13/14
CL-BA-2014:1538 glib2 bug fix and enhancement update 	                10/13/14
CL-BA-2014:1531 ccid bug fix update 	                                10/13/14
CL-EA-2014:1472 elfutils bug fix and enhancement update 	        10/13/14
CL-BA-2014:1506 cmake bug fix and enhancement update 	                10/13/14
CL-BA-2014:1585 gnome-session bug fix and enhancement update 	        10/13/14
CL-BA-2014:1406 dhcp bug fix update 	                                10/13/14
CL-BA-2014:1460 hal bug fix and enhancement update 	                10/13/14
CL-BA-2014:1548 mod_nss bug fix update 	                                10/13/14
CL-SA-2014:1307 Important: nss security update 	                         9/26/14
CL-SA-2014:1167 Important: kernel security and bug fix update 	          9/9/14
CL-EA-2014:1105 libvpx enhancement update 	
===

Additional info:

Dependency-resolution in spacewalk-clone-by-date is required in order to insure that everything in a cloned channel is installable. Sometimes, this results in behavior that appears odd to the user. We need to look closely at user reports, and make sure not to respond with code-change when explanation is correct.

Comment 1 Grant Gainey 2016-08-22 19:25:52 UTC
spacewalk.github:
e74982b2c68969e8865895ab73f59f7cb1484f9a

Comment 4 Radovan Drazny 2016-10-04 12:36:50 UTC
I have cloned a channel using the debug.conf from the initial report and command line "spacewalk-clone-by-date --config=debug.conf -d 2013-11-20" with spacewalk-utils-2.3.2-25. Channel appears to pass repoclosure test - all packages are installable.

Upgraded to spacewalk-utils-2.3.2-26, and performed the same cloning process.

Resulting channel doesn't pass the test with repoclosure - the package "ipa-python" is not installable. It seems that python-nss-0.16.0-1.el6.x86_64 haven't got pulled in, or more exactly, ipa-python-3.0.0-47.el6_7.2.x86_64 got pulled in, and it has this version of python-nss as a dependency. This version of ipa-python is not present in the cloned channel created with spacewalk-utils-2.3.2-25. 

# yum install --disablerepo=beaker* ipa-python
Loaded plugins: product-id, rhnplugin, security, subscription-manager
This system is receiving updates from RHN Classic or RHN Satellite.
Setting up Install Process
Resolving Dependencies
--> Running transaction check
---> Package ipa-python.x86_64 0:3.0.0-47.el6_7.2 will be installed
--> Processing Dependency: python-nss >= 0.16 for package: ipa-python-3.0.0-47.el6_7.2.x86_64
--> Processing Dependency: python-kerberos >= 1.1-3 for package: ipa-python-3.0.0-47.el6_7.2.x86_64
--> Processing Dependency: python-netaddr for package: ipa-python-3.0.0-47.el6_7.2.x86_64
--> Processing Dependency: libipa_hbac-python for package: ipa-python-3.0.0-47.el6_7.2.x86_64
--> Running transaction check
---> Package ipa-python.x86_64 0:3.0.0-47.el6_7.2 will be installed
--> Processing Dependency: python-nss >= 0.16 for package: ipa-python-3.0.0-47.el6_7.2.x86_64
---> Package libipa_hbac-python.x86_64 0:1.12.4-47.el6_7.8 will be installed
--> Processing Dependency: libipa_hbac = 1.12.4-47.el6_7.8 for package: libipa_hbac-python-1.12.4-47.el6_7.8.x86_64
--> Processing Dependency: libipa_hbac.so.0(IPA_HBAC_0.0.1)(64bit) for package: libipa_hbac-python-1.12.4-47.el6_7.8.x86_64
--> Processing Dependency: libipa_hbac.so.0()(64bit) for package: libipa_hbac-python-1.12.4-47.el6_7.8.x86_64
---> Package python-kerberos.x86_64 0:1.1-6.2.el6 will be installed
---> Package python-netaddr.noarch 0:0.7.5-4.el6 will be installed
--> Running transaction check
---> Package ipa-python.x86_64 0:3.0.0-47.el6_7.2 will be installed
--> Processing Dependency: python-nss >= 0.16 for package: ipa-python-3.0.0-47.el6_7.2.x86_64
---> Package libipa_hbac.x86_64 0:1.12.4-47.el6_7.8 will be installed
--> Finished Dependency Resolution
Error: Package: ipa-python-3.0.0-47.el6_7.2.x86_64 (debug2-post-rhel6-x86_64-server-6)
           Requires: python-nss >= 0.16
           Available: python-nss-0.8-3.el6.x86_64 (debug2-post-rhel6-x86_64-server-6)
               python-nss = 0.8-3.el6
           Available: python-nss-0.11-3.el6.x86_64 (debug2-post-rhel6-x86_64-server-6)
               python-nss = 0.11-3.el6
           Available: python-nss-0.13-1.el6.x86_64 (debug2-post-rhel6-x86_64-server-6)
               python-nss = 0.13-1.el6
 You could try using --skip-broken to work around the problem
 You could try running: rpm -Va --nofiles --nodigest

FailedQA

Comment 6 Grant Gainey 2016-10-04 16:55:45 UTC
Cloning-whole-errata-required-for-dependencies was added with 

  spacewalk.github 92e00ce930600093b1e75fd65b8f1dd2d08fa6f9

That change insures we clone the whole erratum - but does not add all of the resulting packages to the "list of nevras we need to do dep-resolution for". So in this case, I believe a released-without-erratum RPM required a version of libtbd which pulled in RHSA-2016:0612 which included ipa-python-3.0.0-47. ipa-python-3.0.0-47 requires python-nss >= 0.16, which is delivered by RHBA-2015:1324. But since ipa-python wasn't *directly* required for dep-resolution, its dependencies weren't evaluated, and the 'secondary' erratum wasn't cloned.

Investigation continues on whether or not we can fix this...

Comment 7 Grant Gainey 2016-10-05 19:29:23 UTC
To address this requires CBD to add the RPMs of any depsolv-discovered-erratum to the list of "packages we need to do dependency-resolution for", and continue the depsolv loop/recursion. This will result in a channel whose dependencies are all found - but it can add a significant number of RPMs/erratum to the resulting cloned channel.

Example:

BEFORE fixing:
# spacewalk-clone-by-date -u foo -p bar -l rhel-x86_64-server-6 debug2-rhel6-x86_64-server-6 -d 2013-11-20 -y 
...
60 RPM(s) added to debug4-rhel6-x86_64-server-6 to resolve dependencies.
36 errata added to debug4-rhel6-x86_64-server-6 to resolve dependencies.
...

AFTER the fix:
# spacewalk-clone-by-date -u foo -p bar -l rhel-x86_64-server-6 debug2-rhel6-x86_64-server-6 -d 2013-11-20 -y 
...
809 RPM(s) added to debug5-rhel6-x86_64-server-6 to resolve dependencies.
82 errata added to debug5-rhel6-x86_64-server-6 to resolve dependencies.
...

To give the user the option to *not* do this, fixing any resulting dependency issues manually, we add a new switch to CBD, "--skip-errata-depsolve", which reverts back to the behavior of #c4.

spacewalk.github:
fcd8ddd1c522c2bf46ef55fa7a54cd7ccec8994d

Along the way, we put the CBD swicthes in alpha-order in --help and manpage, because there are too many to find easily otherwise.

spacewalk.github:
cd8b141abf09f21fed4391fd98784b31f2893ff5

Comment 15 Radovan Drazny 2016-10-24 11:03:30 UTC
Tested on spacewalk-utils-2.3.2-30.el6sat.noarch.rpm

Cloned channels using the config from the initial report. 

The cloning run with the new "-x" option:

# spacewalk-clone-by-date -c debug-final-withx.conf -d 2013-11-20 -x
Reading repository information.
Using issue_date.

By continuing the following channels will be created:
debug-30-withx-rhel-x86_64-server-optional-6, debug-30-withx-rhel6-x86_64-server-6
Cloning rhel-x86_64-server-6 to debug-30-withx-rhel6-x86_64-server-6 with original package set.
Cloning rhel-x86_64-server-optional-6 to debug-30-withx-rhel-x86_64-server-optional-6 with original package set.
Copying repodata, please wait.
Solving Dependencies (6093):
________________________________________
######################################## - complete
Processing Dependencies:
________________________________________
######################################## - complete
Dependencies added, looking for new dependencies
Solving Dependencies (97):
________________________________________
######################################## - complete
Processing Dependencies:
________________________________________
######################################## - complete
Dependencies added, looking for new dependencies
Solving Dependencies (58):
________________________________________
######################################## - complete
Processing Dependencies:
________________________________________
######################################## - complete
Dependencies added, looking for new dependencies
Solving Dependencies (5):
________________________________________
######################################## - complete
Processing Dependencies:
________________________________________
######################################## - complete
60 RPM(s) added to debug-30-withx-rhel6-x86_64-server-6 to resolve dependencies.
36 errata added to debug-30-withx-rhel6-x86_64-server-6 to resolve dependencies.
40 RPM(s) added to debug-30-withx-rhel-x86_64-server-optional-6 to resolve dependencies.
21 errata added to debug-30-withx-rhel-x86_64-server-optional-6 to resolve dependencies.
Please see /var/log/rhn/errata-clone.log for details.

By continuing the following will be cloned:
  rhel-x86_64-server-6 -> debug-30-withx-rhel6-x86_64-server-6  (2191/3670 Errata)
  rhel-x86_64-server-optional-6 -> debug-30-withx-rhel-x86_64-server-optional-6  (1130/1969 Errata)
Cloning Errata into debug-30-withx-rhel6-x86_64-server-6 (2191):
________________________________________
######################################## - complete
Cloning Errata into debug-30-withx-rhel-x86_64-server-optional-6 (1130):
________________________________________
######################################## - complete
Copying repodata, please wait.
Solving Dependencies (12412):
________________________________________
######################################## - complete
Processing Dependencies:
________________________________________
######################################## - complete
Dependencies added, looking for new dependencies
Solving Dependencies (6):
________________________________________
######################################## - complete
Processing Dependencies:
________________________________________
######################################## - complete
Dependencies added, looking for new dependencies
Solving Dependencies (2):
________________________________________
######################################## - complete
Processing Dependencies:
________________________________________
######################################## - complete
1 RPM(s) added to debug-30-withx-rhel6-x86_64-server-6 to resolve dependencies.
1 errata added to debug-30-withx-rhel6-x86_64-server-6 to resolve dependencies.
3 RPM(s) added to debug-30-withx-rhel-x86_64-server-optional-6 to resolve dependencies.
3 errata added to debug-30-withx-rhel-x86_64-server-optional-6 to resolve dependencies.
Please see /var/log/rhn/errata-clone.log for details.

There are missing dependencies for given arch and channel (as described in comment #4), as expected.


The cloning run without the new "-x" option:
# spacewalk-clone-by-date -c debug-final.conf -d 2013-11-20
Reading repository information.
Using issue_date.

By continuing the following channels will be created:
debug-30-nox-rhel-x86_64-server-optional-6, debug-30-nox-rhel6-x86_64-server-6
Cloning rhel-x86_64-server-6 to debug-30-nox-rhel6-x86_64-server-6 with original package set.
Cloning rhel-x86_64-server-optional-6 to debug-30-nox-rhel-x86_64-server-optional-6 with original package set.
Copying repodata, please wait.
Solving Dependencies (6093):
________________________________________
######################################## - complete
Processing Dependencies:
________________________________________
######################################## - complete
Dependencies added, looking for new dependencies
Solving Dependencies (410):
________________________________________
######################################## - complete
Processing Dependencies:
________________________________________
######################################## - complete
Dependencies added, looking for new dependencies
Solving Dependencies (527):
________________________________________
######################################## - complete
Processing Dependencies:
________________________________________
######################################## - complete
Dependencies added, looking for new dependencies
Solving Dependencies (229):
________________________________________
######################################## - complete
Processing Dependencies:
________________________________________
######################################## - complete
Dependencies added, looking for new dependencies
Solving Dependencies (31):
________________________________________
######################################## - complete
Processing Dependencies:
________________________________________
######################################## - complete
Dependencies added, looking for new dependencies
Solving Dependencies (2):
________________________________________
######################################## - complete
Processing Dependencies:
________________________________________
######################################## - complete
809 RPM(s) added to debug-30-nox-rhel6-x86_64-server-6 to resolve dependencies.
82 errata added to debug-30-nox-rhel6-x86_64-server-6 to resolve dependencies.
192 RPM(s) added to debug-30-nox-rhel-x86_64-server-optional-6 to resolve dependencies.
27 errata added to debug-30-nox-rhel-x86_64-server-optional-6 to resolve dependencies.
Please see /var/log/rhn/errata-clone.log for details.

By continuing the following will be cloned:
  rhel-x86_64-server-6 -> debug-30-nox-rhel6-x86_64-server-6  (2180/3624 Errata)
  rhel-x86_64-server-optional-6 -> debug-30-nox-rhel-x86_64-server-optional-6  (1127/1963 Errata)
Cloning Errata into debug-30-nox-rhel6-x86_64-server-6 (2180):
________________________________________
######################################## - complete
Cloning Errata into debug-30-nox-rhel-x86_64-server-optional-6 (1127):
________________________________________
######################################## - complete
Copying repodata, please wait.
Solving Dependencies (12357):
________________________________________
######################################## - complete
Processing Dependencies:
________________________________________
######################################## - complete
Dependencies added, looking for new dependencies
Solving Dependencies (4):
________________________________________
######################################## - complete
Processing Dependencies:
________________________________________
######################################## - complete
Dependencies added, looking for new dependencies
Solving Dependencies (2):
________________________________________
######################################## - complete
Processing Dependencies:
________________________________________
######################################## - complete
1 RPM(s) added to debug-30-nox-rhel6-x86_64-server-6 to resolve dependencies.
1 errata added to debug-30-nox-rhel6-x86_64-server-6 to resolve dependencies.
2 RPM(s) added to debug-30-nox-rhel-x86_64-server-optional-6 to resolve dependencies.
2 errata added to debug-30-nox-rhel-x86_64-server-optional-6 to resolve dependencies.
Please see /var/log/rhn/errata-clone.log for details.


Number of cloned packages is much higher (809+82) compared to the run with the "-x" (60+36). The new cloned channel is repoclosed for given arch. 
VERIFIED

Comment 17 errata-xmlrpc 2016-11-07 13:38:28 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2016-2662.html


Note You need to log in before you can comment on or make changes to this bug.