Bug 441677 - yum-security plugin needs to pull in non-security dependancies
yum-security plugin needs to pull in non-security dependancies
Status: CLOSED ERRATA
Product: Fedora
Classification: Fedora
Component: yum-utils (Show other bugs)
8
All Linux
low Severity low
: ---
: ---
Assigned To: James Antill
Fedora Extras Quality Assurance
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2008-04-09 09:45 EDT by Bradley
Modified: 2008-11-26 05:56 EST (History)
4 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2008-11-26 05:56:09 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:


Attachments (Terms of Use)
debug output (126.41 KB, text/plain)
2008-04-09 09:45 EDT, Bradley
no flags Details
debug output with patch (specifying package name) (4.29 KB, text/plain)
2008-04-09 11:18 EDT, Bradley
no flags Details
Without the package name (2.84 KB, text/plain)
2008-04-09 11:19 EDT, Bradley
no flags Details

  None (edit)
Description Bradley 2008-04-09 09:45:32 EDT
Description of problem:

Using yum --security, if a package has a dependency that is being excluded
(because its not a security package), the rpm install fails. Instead, any
security packages and all dependencies should be installed (even if they're not
security updates themselves)

Version-Release number of selected component (if applicable):

yum-3.2.8-2.fc8
yum-security-1.1.11-1.fc8

xine-lib-1.1.11-1.fc8
xine-lib-extras-nonfree-1.1.11-1.lvn8

How reproducible:

Always

Steps to Reproduce:
1. Have above xine packages installed
2. Ensure that the updated 1.1.11.1-1 RPMs are available (both local and livna
mirrors)
3. yum --security -y update
  
Actual results:

Packages download, but install fails with:

ERROR with rpm_check_debug vs depsolve:
Package xine-lib-extras-nonfree needs xine-lib = 1.1.11, this is not available.

Expected results:

xine-lib-extras-nonfree is downloaded as well and installed to meet dependancies

Additional info:

- Debug (-d 5) attached

- yum update xine-lib (without --security) does work, so all the metadata on my
mirror is definitely OK.
Comment 1 Bradley 2008-04-09 09:45:32 EDT
Created attachment 301805 [details]
debug output
Comment 2 James Antill 2008-04-09 10:23:55 EDT
 Can you try this patch:

http://people.redhat.com/jantill/yum/patches/yum-sec-installed.patch
Comment 3 James Antill 2008-04-09 10:46:58 EDT
 Also, if that doesn't work ... can you add the output for the "yum -d 5 update
xine-libs" case.
Comment 4 Bradley 2008-04-09 11:18:35 EDT
Created attachment 301830 [details]
debug output with patch (specifying package name)

Well, sort of. With 'yum --security update xine-lib' it works.

However, if I don't specify a package name it fails. The new output says that
its updating 3 of 4 packages (the old one said 1 of 2), but it still doesn't
pull in the dep.

This debug is specifying the package name; the following one will be without
any package.
Comment 5 Bradley 2008-04-09 11:19:05 EDT
Created attachment 301831 [details]
Without the package name
Comment 6 Bradley 2008-04-09 11:19:52 EDT
Both those attachments were with the patch manually applied.
Comment 7 James Antill 2008-04-09 13:16:43 EDT
 Ok, I'm pretty sure I've fixed this. Here's an updated security plugin:

http://people.redhat.com/jantill/yum/plugins/security.py

...just copy over the old one, I've only tested with 3.2.14 ... but it should
work :).
Comment 8 Bradley 2008-04-09 20:38:59 EDT
That works, thanks. It does still say:

Needed 3 of 4 packages, for security

though.
Comment 9 James Antill 2008-04-09 23:13:26 EDT
 Ok, thanks. I'll leave this BZ open at least until the fix is in rawhide.

 The message is intentional ... and is saying it removed 1 package from a normal
"yum update" (i.e. it needed 3 of the 4 available packages, due to security).
Comment 10 Bradley 2008-04-10 00:13:20 EDT
But there are only 2 available packages, only one of which is a security
issue... Without the patch it said 1 of 2; it should say either 1/2 or 2/2
(making sure not to overcount if the extra package wasn't an update but was an
extra prereq)
Comment 11 James Antill 2008-04-10 00:28:08 EDT
 Right, I've also changed it upstream to say "transactional packages" which is
kind of what it is counting.
 The extra numbers are because it's counting the old xine-lib packages you have
installed (which are being removed as part of the transaction).
Comment 12 Bug Zapper 2008-11-26 05:27:18 EST
This message is a reminder that Fedora 8 is nearing its end of life.
Approximately 30 (thirty) days from now Fedora will stop maintaining
and issuing updates for Fedora 8.  It is Fedora's policy to close all
bug reports from releases that are no longer maintained.  At that time
this bug will be closed as WONTFIX if it remains open with a Fedora 
'version' of '8'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version' 
to a later Fedora version prior to Fedora 8's end of life.

Bug Reporter: Thank you for reporting this issue and we are sorry that 
we may not be able to fix it before Fedora 8 is end of life.  If you 
would still like to see this bug fixed and are able to reproduce it 
against a later version of Fedora please change the 'version' of this 
bug to the applicable version.  If you are unable to change the version, 
please add a comment here and someone will do it for you.

Although we aim to fix as many bugs as possible during every release's 
lifetime, sometimes those efforts are overtaken by events.  Often a 
more recent Fedora release includes newer upstream software that fixes 
bugs or makes them obsolete.

The process we are following is described here: 
http://fedoraproject.org/wiki/BugZappers/HouseKeeping
Comment 13 Bradley 2008-11-26 05:56:09 EST
Fixed for F10 (and was earlier pushed to F8 as an update, IIRC)

Note You need to log in before you can comment on or make changes to this bug.