Older binary versions are accepted after a package is deleted in the same suite
| Affects | Status | Importance | Assigned to | Milestone | |
|---|---|---|---|---|---|
| Launchpad itself |
Triaged
|
High
|
Unassigned | ||
Bug Description
Soyuz doesn't perform enough checks on the versions of uploaded binaries.
It will check that there isn't already a published binary newer than the candidate in the same distrorelease, including the correct handling for backports.
However, it will not check in prior distroreleases. So, if a package was in dapper, previously removed in edgy, and then a new source upload to edgy builds an older version of the same binary package, it will be accepted and published, when it shouldn't be.
This happened recently with the binary package ndiswrapper-utils, which is in edgy at version 1.1-5 (from the source package named "ndiswrapper-
There was also some discussion of a stronger check, which would forbid publishing a version of a package which was lower than any version previously published, in that or any prior distrorelease, even if the previous version has been removed.
This is theoretically do-able in Soyuz, but could get complex; if a very high version number were accidentally uploaded and quickly deleted, and we wanted to work around the check in this case, we'd need to erase it entirely from history, or have a second "seriously, this is REALLY removed, kthxbye" status, alongside the existing removed status, to indicate that the check shouldn't apply. It sounds like this stronger check is not sufficiently required to complicate things so.
But, in the meantime, we do need to properly check against still-published higher version releases anywhere else in the distribution.
| Changed in soyuz: | |
| importance: | Undecided → High |
| status: | Unconfirmed → Confirmed |
| Malcolm Cleaton (malcolmcleaton) wrote | #1 |
| Adam Conrad (adconrad) wrote | #2 |
| tags: | added: soyuz-upload |
| Robert Collins (lifeless) wrote | #4 |
| summary: |
- Binary versions not checked correctly + Older binary versions are accepted after a package is deleted in the + same suite |
| William Grant (wgrant) wrote | #5 |
| William Grant (wgrant) wrote | #6 |
We should also either try to refuse source package uploads which we can see will lead to a build which will be refused, or make sure we fix bugs 32261 and 32404, so that rejecting a build result doesn't have such sucky outcomes. Or maybe both.