Bug#1110359: libatlas3-base: insufficient dependency on libblas3

[Helmut Grohne]

Package: libatlas3-base
Version: 3.12.1-4
Severity: serious
Justification: insufficient dependency
Tags: patch

A partial upgrade of libatlas3-base may render the library broken and
libblas.so.3 may be gone. This situation does normally not arise,
because apt usually upgrades all binary packages from the same source
package together, but it can still be encountered in complex upgrades.

mmdebstrap bookworm /dev/null http://deb.debian.org/debian --variant=apt --include=libatlas3-base,libblas3 --chrooted-customize-hook='sed -i -e s/bookworm/trixie/ /etc/apt/sources.list && apt update && apt-get -o APT::Get::Upgrade-By-Source-Package=False install -y libatlas3-base && ls -la /usr/lib/x86_64-linux-gnu/libblas.so.3'

This reproducer lifts the lock-step upgrade to simulate upgrading to the
transitional package only. Once doing so, the alternative is a dangling
symbolic link and libblas.so.3 is gone. Upgrading libblas3 resolves the
problems, so most systems will not practically experience this symptom.

The solution to this problem is good practice: Transitional packages
should issue a versioned dependency. libatlas3-base should really
"Depends: libblas3 (= ${binary:Version})". Another good practice is for
them to be of the same architecture and Multi-Arch value as their target
package, so libatlas3-base should switch from Arch:all to Arch:any and
become M-A:same. Doing otherwise breaks multiarch-enabled upgrades.

I recommend trying to fix this for trixie.

--- a/debian/control
+++ b/debian/control
@@ -315,8 +315,9 @@
  This package contains a shared version of the library.
 
 Package: libatlas3-base
-Depends: libblas3, ${misc:Depends}
-Architecture: all
+Depends: libblas3 (= ${binary:Version}), ${misc:Depends}
+Architecture: any
+Multi-Arch: same
 Section: oldlibs
 Description: transitional package
  This is a transitional package. It can safely be removed.

Helmut